9 ms·

French Court Allows Reverse Engineering of Skype Protocol

243 points by p4bl0 13y ago

cynwoody 13y ago
Reverse engineering of protocols should be as American as the First Amendment!
- ars 13y ago
  I'm pretty sure it's legal in the US as well. The gold method is two teams: One reverse engineers and writes documentation, and the second team implements based on the documentation and never sees the original. The question is if it's legal to talk to the skype servers this way.....
  - slig 13y ago
    This is known as http://en.wikipedia.org/wiki/Clean_room_design http://en.wikipedia.org/wiki/Clean_room_design
username42 13y ago
Sometimes, we can be proud to be french ;-) For interoperability purpose, "reverse engineering is a legal practice, and that the distribution of software using a protocol found in this way is not illegal"
- marincounty 13y ago
  I have no problems with your country. Any country that ties traffic infractions to income is fine with me. I heard most of your schooling is free to? The French have a lot we(USA) should look into.
  - pingou 13y ago
    There's no such thing in France, maybe you're mistaken with some Nordic countries? Edit : I was talking about the traffic fines. Source : I'm French, which may explain my broken English.
    - moystard 13y ago
      School is free until high school in France, and university can be considered as free as well, because it is extremely cheap compared to the USA/Canada/UK for example, and because there is plenty of help to students with low resources.
      - jlgreco 13y ago
        > School is free until high school in France Friendly fyi: "until" is generally exclusive in English. An similar word that is inclusive is "through". So "I'm on vacation until Monday" implies they will be in the office on Monday, but "I'm on vacation through Monday" implies they will be back Tuesday. I understood what you meant, but for a moment I thought you were saying that you had to pay for highschool in France.
    - vvvVVVvvv 13y ago
      France, Sweden, Finland, Germany, Ireland, Poland, (etc ...) what's the difference when you're not from the EU ? =)
    - byroot 13y ago
      > maybe you're mistaken with some Nordic countries? I think it's switzerland [0] [0] http://www.rts.ch/info/suisse/1118676-bientot-des-amendes-selon-le-revenu.html http://www.rts.ch/info/suisse/1118676-bientot-des-amendes-se...
  - bpizzi 13y ago
    French school isn't free, you're just basically paying it afterwards, threw many taxes including personnal income based taxes.
- mercurial 13y ago
  Makes me wonder how much reverse engineering the DGSE has done...
- nraynaud 13y ago
  It's a bit more complicated, you can reverse-engineer if the company is not willing to give the protocol, for interoperability purpose only and you are not allowed to publish the raw information you obtained during the reverse, but only a new interoperable product. Journalistic treatment has probably distorted the facts so someone should probably go read the actual decision.
  - panzi 13y ago
    What do you mean by "raw information"? Can you publish a detailed protocol specification?
    - nraynaud 13y ago
      Here is a rough translation, I'm sorry to tell that I have a hard time parsing the original in the context of OSS too. IV. The reproduction of the code of the software or the translation of the shape of the code is not subject to the author's authorization when the reproduction or translation in the sense of 1° and 2° of article L. 122-6 is essential to get the information necessary to the interoperability of an independently created software with other softwares provided the following conditions are met: 1) those actions are fulfilled by the person with the right to use one copy of the software or on his behalf by someone empowered to this end; 2) the informations needed for interoperability have not been easily and quickly available to the people mentioned at 1° above; 3) and those actions are limited to the part of the original software needed to this interoperabilty The information obtained this way [disassembly] shall not be: 1) Neither used for any other purpose than interoperability of the independently created software 2) Neither communicated to thirds parties unless that is necessary for the interoperability of the independently created software 3) Neither used for development, production or sale of a software whose expression is substantially similar or for any other act infringing the author's copyright
  - naterator 13y ago
    Further along the lines of what panzi is asking, could you publish OSS that contains code that would make obvious how to interact with the protocol?
- macmac 13y ago
  There are many reasons to be proud to be French, but since the French law is just an implementation of an EU directive this is hardly one of them.
  - kleiba 13y ago
    Frankly, I never understood why anyone should be proud because they happen to be of a certain nationality.
    - stinos 13y ago
      It's like being proud of coincidence. Weird, but hey, why not?
      - vdaniuk 13y ago
        Because it skews your priorities and introduces more cognitive biases?
    - dalore 13y ago
      I'm proud I rolled a 6 on my dice.
      - nnnnni 13y ago
        But... that's one less than average! (Assuming 2d6)
        dalore 13y ago
        Who wants to be average?
    - emiliobumachar 13y ago
      Though it may look otherwise, the opinions of citizens have a fair weight in government policy.
    - shard 13y ago
comex 13y ago
I wonder what would have happened in the United States. I think the DMCA probably couldn't be construed to apply to this, but I guess accessing Skype's servers could be considered exceeding authorized access, similar to the 3Taps case (http://www.mediapost.com/publications/article/207055/#axzz2iWzTwYAH http://www.mediapost.com/publications/article/207055/#axzz2i...)...
bifrost 13y ago
This makes me laugh, mostly because it will alienate the French govt from the US Govt, but also because its basically anti-IP.
- Gmo 13y ago
  You forgot the main reason : because it goes against your preconceived ideas about "The French".
  - bifrost 13y ago
    I'm not sure I follow, the only preconceived ideas I have about the French relate to food and music. If the French want to tick off the USGovt, I have no quarrel.
- weland 13y ago
  > but also because its basically anti-IP. And, most remarkably, according to the EU legislation which tends to hinder lobbyists, at least once in a blue moon.
tobiasu 13y ago
The court follows the EC Directive for legal protection of computer programs, specifically Article 6. Every EU country should have laws in place that allow for reverse engineering within certain limits. See page 4 [PDF]: http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2009:111:0016:0022:EN:PDF http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2...
Systemic33 13y ago
Protocols are like languages, in the sense that they aren't the data or protection of data, but provides a structural framework for communicating. Languages are also in itself not information, and not secure, it's only when you apply security that happens. This can be compared to letting people try reverse engineer some indigenous language in my eyes.
Fuxy 13y ago
Hmm... it seems European law seems to fair a lot better then American law when it comes to attempted abuse by big companies. I don't know if it's just because the judges are more sane but well done. I think I respect the french slightly more now :)
- illumen 13y ago
  The EU company sold skype to an american company. Now they don't care to protect it.
- rayiner 13y ago
  Reverse engineering is quite legal in the U.S. too.
- josteink 13y ago
  It might also be because of less lobbying efforts targeting the EU. The EU has had a few incidents where targeted lobbying efforts from the entertainment-industry almost has gone through unnoticed and uncontested.
meleva 13y ago
Can someone explain why this is a significant decision ?
chatman 13y ago
I really hope Pidgin/Audium leverages the source code, or someone else does it and makes a Pidgin plugin. The native Skype client on Linux crashes quite a bit.
StavrosK 13y ago
I'm afraid that this, while a significant decision, will lot mean much in practice. Companies can play cat and mouse indefinitely, and have more resources than hobbyists, if they need their protocols to remain secret.
- mtrimpe 13y ago
  A French company should now be able to offer a chat messenger which is interoperable with Skype for sale, potentially giving it to keep up with the cat and mouse game.
  - alkonaut 13y ago
    It will be easy for free software to offer such a solution, the problem is that commercial software probably can't promise much about how much or how long it will be interoperable. I'd be reluctant to pay for a commercial skype client that can break tomorrow.
    - mtrimpe 13y ago
      The free version could also break at any time of course. What you'd be paying for the privilege of having a client that works again the day after tomorrow. Also, the ability to run chat bots on the Skype network is something that can be quite valuable for certain companies.
    - MichaelGG 13y ago
      Well aren't there a lot of licensed physical devices with a Skype client (I'm thinking actual phones)? A breaking change would require an update to the firmware on those devices, which seems non-trivial.
    - m-r-r 13y ago
      In the case of Skype, your right: Skype can probably change their protocols and ruin the work of the reverse enginners. But this would have a price: Skype users would have to install the last version of the client to be able to communicate with their contacts. If Microsoft started to modify the Skype protocol each week, the users would probably get tired of updating their client weekly and they would use another software. For others proprietary softwares, breaking the compatibility with old versions is hardly conceivable: If Photoshop or AutoCAD where suddenly unable to use read and write the terabytes of data created by their users, those users would probably throw their PC through the window and never buy again a proprietary software...
steeve 13y ago
A friend of mine, @ouanilo (french), actually reversed the Skype protocol: http://www.oklabs.net/skype-reverse-engineering-the-long-journey/ http://www.oklabs.net/skype-reverse-engineering-the-long-jou... Wondering why it didn't really get out there tho. The rest of the website has more information about the journey, and an actual fake Skype client.
apierre 13y ago
Eet iz formidable!
deleted 13y ago
[deleted]
devx 13y ago
Didn't Microsoft basically reverse engineer Google's Youtube API's to make that WP8 Youtube app? I wonder if Google will consider integrating a reverse engineered Skype into Hangouts. Not that I'm particularly excited myself about joining a fully spied upon chat service, but it would be an interesting move.
alkonaut 13y ago
Wasn't this the case with ICQ? That is, once the protocol was reverse engineered, all the protocol authors had to do was change it slightly and the 3rd party implementations had to play catch up.

243 points by p4bl0 13y ago

cynwoody 13y ago

Reverse engineering of protocols should be as American as the First Amendment!

ars 13y ago
I'm pretty sure it's legal in the US as well. The gold method is two teams: One reverse engineers and writes documentation, and the second team implements based on the documentation and never sees the original. The question is if it's legal to talk to the skype servers this way.....
- slig 13y ago
  This is known as http://en.wikipedia.org/wiki/Clean_room_design http://en.wikipedia.org/wiki/Clean_room_design

username42 13y ago

Sometimes, we can be proud to be french ;-) For interoperability purpose, "reverse engineering is a legal practice, and that the distribution of software using a protocol found in this way is not illegal"

marincounty 13y ago
I have no problems with your country. Any country that ties traffic infractions to income is fine with me. I heard most of your schooling is free to? The French have a lot we(USA) should look into.
- pingou 13y ago
  There's no such thing in France, maybe you're mistaken with some Nordic countries? Edit : I was talking about the traffic fines. Source : I'm French, which may explain my broken English.
  - moystard 13y ago
    School is free until high school in France, and university can be considered as free as well, because it is extremely cheap compared to the USA/Canada/UK for example, and because there is plenty of help to students with low resources.
    - jlgreco 13y ago
      > School is free until high school in France Friendly fyi: "until" is generally exclusive in English. An similar word that is inclusive is "through". So "I'm on vacation until Monday" implies they will be in the office on Monday, but "I'm on vacation through Monday" implies they will be back Tuesday. I understood what you meant, but for a moment I thought you were saying that you had to pay for highschool in France.
  - vvvVVVvvv 13y ago
    France, Sweden, Finland, Germany, Ireland, Poland, (etc ...) what's the difference when you're not from the EU ? =)
  - byroot 13y ago
    > maybe you're mistaken with some Nordic countries? I think it's switzerland [0] [0] http://www.rts.ch/info/suisse/1118676-bientot-des-amendes-selon-le-revenu.html http://www.rts.ch/info/suisse/1118676-bientot-des-amendes-se...
- bpizzi 13y ago
  French school isn't free, you're just basically paying it afterwards, threw many taxes including personnal income based taxes.
mercurial 13y ago
Makes me wonder how much reverse engineering the DGSE has done...
nraynaud 13y ago
It's a bit more complicated, you can reverse-engineer if the company is not willing to give the protocol, for interoperability purpose only and you are not allowed to publish the raw information you obtained during the reverse, but only a new interoperable product. Journalistic treatment has probably distorted the facts so someone should probably go read the actual decision.
- panzi 13y ago
  What do you mean by "raw information"? Can you publish a detailed protocol specification?
  - nraynaud 13y ago
    Here is a rough translation, I'm sorry to tell that I have a hard time parsing the original in the context of OSS too. IV. The reproduction of the code of the software or the translation of the shape of the code is not subject to the author's authorization when the reproduction or translation in the sense of 1° and 2° of article L. 122-6 is essential to get the information necessary to the interoperability of an independently created software with other softwares provided the following conditions are met: 1) those actions are fulfilled by the person with the right to use one copy of the software or on his behalf by someone empowered to this end; 2) the informations needed for interoperability have not been easily and quickly available to the people mentioned at 1° above; 3) and those actions are limited to the part of the original software needed to this interoperabilty The information obtained this way [disassembly] shall not be: 1) Neither used for any other purpose than interoperability of the independently created software 2) Neither communicated to thirds parties unless that is necessary for the interoperability of the independently created software 3) Neither used for development, production or sale of a software whose expression is substantially similar or for any other act infringing the author's copyright
- naterator 13y ago
  Further along the lines of what panzi is asking, could you publish OSS that contains code that would make obvious how to interact with the protocol?
macmac 13y ago
There are many reasons to be proud to be French, but since the French law is just an implementation of an EU directive this is hardly one of them.
- kleiba 13y ago
  Frankly, I never understood why anyone should be proud because they happen to be of a certain nationality.
  - stinos 13y ago
    It's like being proud of coincidence. Weird, but hey, why not?
    - vdaniuk 13y ago
      Because it skews your priorities and introduces more cognitive biases?
  - dalore 13y ago
    I'm proud I rolled a 6 on my dice.
    - nnnnni 13y ago
      But... that's one less than average! (Assuming 2d6)
      - dalore 13y ago
        Who wants to be average?
  - emiliobumachar 13y ago
    Though it may look otherwise, the opinions of citizens have a fair weight in government policy.
  - shard 13y ago

comex 13y ago

I wonder what would have happened in the United States. I think the DMCA probably couldn't be construed to apply to this, but I guess accessing Skype's servers could be considered exceeding authorized access, similar to the 3Taps case (http://www.mediapost.com/publications/article/207055/#axzz2iWzTwYAH http://www.mediapost.com/publications/article/207055/#axzz2i...)...

bifrost 13y ago

This makes me laugh, mostly because it will alienate the French govt from the US Govt, but also because its basically anti-IP.

Gmo 13y ago
You forgot the main reason : because it goes against your preconceived ideas about "The French".
- bifrost 13y ago
  I'm not sure I follow, the only preconceived ideas I have about the French relate to food and music. If the French want to tick off the USGovt, I have no quarrel.
weland 13y ago
> but also because its basically anti-IP. And, most remarkably, according to the EU legislation which tends to hinder lobbyists, at least once in a blue moon.

tobiasu 13y ago

The court follows the EC Directive for legal protection of computer programs, specifically Article 6. Every EU country should have laws in place that allow for reverse engineering within certain limits. See page 4 [PDF]: http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2009:111:0016:0022:EN:PDF http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2...

Systemic33 13y ago

Protocols are like languages, in the sense that they aren't the data or protection of data, but provides a structural framework for communicating. Languages are also in itself not information, and not secure, it's only when you apply security that happens. This can be compared to letting people try reverse engineer some indigenous language in my eyes.

Fuxy 13y ago

Hmm... it seems European law seems to fair a lot better then American law when it comes to attempted abuse by big companies. I don't know if it's just because the judges are more sane but well done. I think I respect the french slightly more now :)

illumen 13y ago
The EU company sold skype to an american company. Now they don't care to protect it.
rayiner 13y ago
Reverse engineering is quite legal in the U.S. too.
josteink 13y ago
It might also be because of less lobbying efforts targeting the EU. The EU has had a few incidents where targeted lobbying efforts from the entertainment-industry almost has gone through unnoticed and uncontested.

meleva 13y ago

Can someone explain why this is a significant decision ?

chatman 13y ago

I really hope Pidgin/Audium leverages the source code, or someone else does it and makes a Pidgin plugin. The native Skype client on Linux crashes quite a bit.

StavrosK 13y ago

I'm afraid that this, while a significant decision, will lot mean much in practice. Companies can play cat and mouse indefinitely, and have more resources than hobbyists, if they need their protocols to remain secret.

mtrimpe 13y ago
A French company should now be able to offer a chat messenger which is interoperable with Skype for sale, potentially giving it to keep up with the cat and mouse game.
- alkonaut 13y ago
  It will be easy for free software to offer such a solution, the problem is that commercial software probably can't promise much about how much or how long it will be interoperable. I'd be reluctant to pay for a commercial skype client that can break tomorrow.
  - mtrimpe 13y ago
    The free version could also break at any time of course. What you'd be paying for the privilege of having a client that works again the day after tomorrow. Also, the ability to run chat bots on the Skype network is something that can be quite valuable for certain companies.
  - MichaelGG 13y ago
    Well aren't there a lot of licensed physical devices with a Skype client (I'm thinking actual phones)? A breaking change would require an update to the firmware on those devices, which seems non-trivial.
  - m-r-r 13y ago
    In the case of Skype, your right: Skype can probably change their protocols and ruin the work of the reverse enginners. But this would have a price: Skype users would have to install the last version of the client to be able to communicate with their contacts. If Microsoft started to modify the Skype protocol each week, the users would probably get tired of updating their client weekly and they would use another software. For others proprietary softwares, breaking the compatibility with old versions is hardly conceivable: If Photoshop or AutoCAD where suddenly unable to use read and write the terabytes of data created by their users, those users would probably throw their PC through the window and never buy again a proprietary software...

steeve 13y ago

A friend of mine, @ouanilo (french), actually reversed the Skype protocol: http://www.oklabs.net/skype-reverse-engineering-the-long-journey/ http://www.oklabs.net/skype-reverse-engineering-the-long-jou... Wondering why it didn't really get out there tho. The rest of the website has more information about the journey, and an actual fake Skype client.

apierre 13y ago

Eet iz formidable!

deleted 13y ago

[deleted]

devx 13y ago

Didn't Microsoft basically reverse engineer Google's Youtube API's to make that WP8 Youtube app? I wonder if Google will consider integrating a reverse engineered Skype into Hangouts. Not that I'm particularly excited myself about joining a fully spied upon chat service, but it would be an interesting move.

alkonaut 13y ago

Wasn't this the case with ICQ? That is, once the protocol was reverse engineered, all the protocol authors had to do was change it slightly and the 3rd party implementations had to play catch up.