5 ms·

You don’t understand why companies care or you understand, but simply don’t agree? A long time ago, I recall having a conversation with the CTO of a company th

You don’t understand why companies care or you understand, but simply don’t agree? A long time ago, I recall having a conversation with the CTO of a company that made BBS software. We wanted to integrate with his servers, so we wanted the proprietary protocol. We advised him to build an API so that his software would become an ecosystem and thrive. He smiled and metaphorically patted us on the head like a parent explaining the world to children. “If we publish the API for people to write new clients, people can also write new servers that talk to the clients we write, and we’d be out of business.” Skype’s motivation is obvious: If the protocol is public, while some people will write software that enhances the Skype ecosystem, others will compete with Skype, and that isn’t what they want.

huhtenberg 15y ago
Actually Skype's motivation is different. Their system operates under an assumption that all its parts are genuine, and so it places implicit trust into every client and expects it to operate fairly for the system's overall benefit. You open this thing up and there will be 3rd party nodes that do not comply with system's semantics -- supernodes become few and far between (why the hell would anyone be willingly relaying the traffic while on any sort of metered connection?), someone would add an encryption overlay disabling any "lawful interception" provisions they have in place (which they most certainly have or they would've been simply blocked all over the world), someone else would find a weakness in their p2p encryption and start eavesdropping on relayed calls, etc. Does Skype needs this sort of headache? No. Hence the highly obfuscated and encrypted binary with numerous anti-debugging and anti-reversing traps, and their very active suppression of reverse engineering attempts. Skype would basically stop working if it is ever open.
- mattgreenrocks 15y ago
  This makes sense. Thanks for the insight.
- nobody31 15y ago
  I suspect that skype's motivation is more that it charges for calls out to a landline and for calls in. It uses these profits to pay for the free skype-skype service. If I could access the skype protocol I could route all my phone calls over skype->landline and not pay them. Unless of course they actually implemented the security system properly and have a secure method for identifying each end of the call - but they wouldn't have needed to do that because it's all secret.

huhtenberg 15y ago

Actually Skype's motivation is different. Their system operates under an assumption that all its parts are genuine, and so it places implicit trust into every client and expects it to operate fairly for the system's overall benefit. You open this thing up and there will be 3rd party nodes that do not comply with system's semantics -- supernodes become few and far between (why the hell would anyone be willingly relaying the traffic while on any sort of metered connection?), someone would add an encryption overlay disabling any "lawful interception" provisions they have in place (which they most certainly have or they would've been simply blocked all over the world), someone else would find a weakness in their p2p encryption and start eavesdropping on relayed calls, etc. Does Skype needs this sort of headache? No. Hence the highly obfuscated and encrypted binary with numerous anti-debugging and anti-reversing traps, and their very active suppression of reverse engineering attempts. Skype would basically stop working if it is ever open.

mattgreenrocks 15y ago
This makes sense. Thanks for the insight.
nobody31 15y ago
I suspect that skype's motivation is more that it charges for calls out to a landline and for calls in. It uses these profits to pay for the free skype-skype service. If I could access the skype protocol I could route all my phone calls over skype->landline and not pay them. Unless of course they actually implemented the security system properly and have a secure method for identifying each end of the call - but they wouldn't have needed to do that because it's all secret.