4 ms·

I haven't spent much time browsing through the source but the code quality and security is pretty dismal so far. Not to mention the confusing project structure.

by andwur 10y ago

I haven't spent much time browsing through the source but the code quality and security is pretty dismal so far. Not to mention the confusing project structure. Magic numbers, ... and strings, all over the place [0]. Memory leak galore (debug code?) [1]. Probably buffer overflows all over the place, here's one I noticed [2]. I suspect others given the proliferation of opaque pointers and memcpy usage. [0] https://github.com/skypeopensource/skypeopensource2/blob/master/skycontact4_dll/skycontact4_dll/skype_login.c https://github.com/skypeopensource/skypeopensource2/blob/mas... [1] https://github.com/skypeopensource/skypeopensource2/blob/master/goodsendrelay3/goodsendrelay3/tcp_recv.c#L500 https://github.com/skypeopensource/skypeopensource2/blob/mas... [2] https://github.com/skypeopensource/skypeopensource2/blob/master/skyauth4_dll/skyauth4_dll/skype_login.c#L260 https://github.com/skypeopensource/skypeopensource2/blob/mas...

sillysaurus3 10y ago
"How dare you show your project when it has flaws!"
- andwur 10y ago
  "How dare you comment on the flaws found in someone's project!" If issues are never brought to light then it's very unlikely they will ever be fixed. Would you rather everyone just stayed silent? I have great respect for someone that can put in the time and effort to reverse engineer Skype, and brave Microsoft's legal team in doing so, but in its current state this code can't be used safely and is far from easy to understand either.
  - EvgeniyZh 10y ago
    I believe that the best way to bring issues to light is pull request. Second best is the issue. Comment on Hacker News is somewhere down the list
- showmustgoon 10y ago
  If these flaws are minor or inconsequential, then you might be right about your remark but if these flaws are flagrant or critical, then the OP had the right attitude to make concerns public.
- adekok 10y ago
  A technical review of code isn't a personal attack. Please learn to tell the difference.
mSparks 10y ago
You sound like you expect something different from reversed Microsoft code.
- amelius 10y ago
  I know you are probably joking, but didn't MS buy the code?
  - extra88 10y ago
    Yes, Microsoft bought Skype, it didn't create Skype. There have been many substantive changes since then (e.g. much less peer-to-peer in operation).
    - pbhjpbhj 10y ago
      Is there any peer-to-peer now, I thought they routed everything through their own servers now?
      - extra88 10y ago
        I don't know. It seems stupid to entirely drop peer-to-peer but maybe that's the case now.
        mSparks 10y ago
        only "stupid" if you are opposed to this: http://techrights.org/2015/01/02/snowden-leaks-on-spying/ http://techrights.org/2015/01/02/snowden-leaks-on-spying/ Otherwise, dropping peer to peer is the only way to achieve the projects goals.
viraptor 10y ago
The magic values look ok to me. I mean, some values are known, some aren't - it's still early days. Hopefully more will be labeled / split up into components with time. But I agree that it would be dangerous to use now. And the author isn't a skilled VCS user or open source dev either. (comments say all rights reserved)
- fulafel 10y ago
  "all rights reserved" doesn't conflict with openness, it's a (now obsolete) technicality meaning you opt in to getting your copyright license enforced under an international treaty.
  - viraptor 10y ago
    I meant the whole block not just this phrase. "Copyright (c) 2009 by VEST Corporation. All rights reserved. Strictly Confidential!" - that conflicts with openness. Or at least with assigning rights to other people.
0xmohit 10y ago
You didn't mention the inconsistent (and somewhat weird) formatting of the source code. https://github.com/skypeopensource/skypeopensource2/blob/master/skycontact4_dll/skycontact4_dll/skype_login.c#L202-L204 https://github.com/skypeopensource/skypeopensource2/blob/mas... https://github.com/skypeopensource/skypeopensource2/blob/master/skycontact4_dll/skycontact4_dll/skype_login.c#L212-L214 https://github.com/skypeopensource/skypeopensource2/blob/mas... I cannot specify more examples.
- Retr0spectrum 10y ago
  I think part of it is caused by the tab-width setting. The developer appears to have been using a tab-width of 4, and there are some instances where they used spaces for indentation without realising. The only explains some of the wierdness though. That second link is completely inexplicable.
fungos 10y ago
To me this project looks like really a just reversed and mostly functional one and this is the quality of said projects, I've been there. He has disassembled, transcribed to a C project almost as-is and made it compile. The developer may not have enough development experience to organize it decently or just rushed it online because of anxiety. Anyway, very good resource for others if there still any interest at all at Skype compatibility or else, only missing the .idb with renamed subs and comments. :)
- fungos 10y ago
  Old patched binaries and .idb are on his onion: http://gzscxpillagce2gf.onion/ http://gzscxpillagce2gf.onion/
skypeopensource 10y ago
Yes :-)

by andwur 10y ago

sillysaurus3 10y ago

"How dare you show your project when it has flaws!"

andwur 10y ago
"How dare you comment on the flaws found in someone's project!" If issues are never brought to light then it's very unlikely they will ever be fixed. Would you rather everyone just stayed silent? I have great respect for someone that can put in the time and effort to reverse engineer Skype, and brave Microsoft's legal team in doing so, but in its current state this code can't be used safely and is far from easy to understand either.
- EvgeniyZh 10y ago
  I believe that the best way to bring issues to light is pull request. Second best is the issue. Comment on Hacker News is somewhere down the list
showmustgoon 10y ago
If these flaws are minor or inconsequential, then you might be right about your remark but if these flaws are flagrant or critical, then the OP had the right attitude to make concerns public.
adekok 10y ago
A technical review of code isn't a personal attack. Please learn to tell the difference.

mSparks 10y ago

You sound like you expect something different from reversed Microsoft code.

amelius 10y ago
I know you are probably joking, but didn't MS buy the code?
- extra88 10y ago
  Yes, Microsoft bought Skype, it didn't create Skype. There have been many substantive changes since then (e.g. much less peer-to-peer in operation).
  - pbhjpbhj 10y ago
    Is there any peer-to-peer now, I thought they routed everything through their own servers now?
    - extra88 10y ago
      I don't know. It seems stupid to entirely drop peer-to-peer but maybe that's the case now.
      - mSparks 10y ago
        only "stupid" if you are opposed to this: http://techrights.org/2015/01/02/snowden-leaks-on-spying/ http://techrights.org/2015/01/02/snowden-leaks-on-spying/ Otherwise, dropping peer to peer is the only way to achieve the projects goals.

viraptor 10y ago

The magic values look ok to me. I mean, some values are known, some aren't - it's still early days. Hopefully more will be labeled / split up into components with time. But I agree that it would be dangerous to use now. And the author isn't a skilled VCS user or open source dev either. (comments say all rights reserved)

fulafel 10y ago
"all rights reserved" doesn't conflict with openness, it's a (now obsolete) technicality meaning you opt in to getting your copyright license enforced under an international treaty.
- viraptor 10y ago
  I meant the whole block not just this phrase. "Copyright (c) 2009 by VEST Corporation. All rights reserved. Strictly Confidential!" - that conflicts with openness. Or at least with assigning rights to other people.

0xmohit 10y ago

You didn't mention the inconsistent (and somewhat weird) formatting of the source code. https://github.com/skypeopensource/skypeopensource2/blob/master/skycontact4_dll/skycontact4_dll/skype_login.c#L202-L204 https://github.com/skypeopensource/skypeopensource2/blob/mas... https://github.com/skypeopensource/skypeopensource2/blob/master/skycontact4_dll/skycontact4_dll/skype_login.c#L212-L214 https://github.com/skypeopensource/skypeopensource2/blob/mas... I cannot specify more examples.

Retr0spectrum 10y ago
I think part of it is caused by the tab-width setting. The developer appears to have been using a tab-width of 4, and there are some instances where they used spaces for indentation without realising. The only explains some of the wierdness though. That second link is completely inexplicable.

fungos 10y ago

To me this project looks like really a just reversed and mostly functional one and this is the quality of said projects, I've been there. He has disassembled, transcribed to a C project almost as-is and made it compile. The developer may not have enough development experience to organize it decently or just rushed it online because of anxiety. Anyway, very good resource for others if there still any interest at all at Skype compatibility or else, only missing the .idb with renamed subs and comments. :)

fungos 10y ago
Old patched binaries and .idb are on his onion: http://gzscxpillagce2gf.onion/ http://gzscxpillagce2gf.onion/

skypeopensource 10y ago

Yes :-)