9 ms·

Skype falls victim to text chat bug

63 points by SimplyUseless 11y ago

lalm 11y ago
This raises an interesting point: Skype downloads your chat log from their server. They have your chat log on their server.
- dragos2 11y ago
  How else would you sync conversations across multiple devices? Let's not simply forget about the benefits of a decision.
  - kissickas 11y ago
    I thought they used to only sync chat logs when multiple devices were online, until they switched from a P2P to a cloud-based model. http://blogs.skype.com/2013/10/04/skype-architecture-update/ http://blogs.skype.com/2013/10/04/skype-architecture-update/ http://www.makeuseof.com/tag/skype-enables-synchronization-of-chat-message-history-across-all-your-devices/ http://www.makeuseof.com/tag/skype-enables-synchronization-o...
- meowface 11y ago
  They have stored chat logs on their server for many, many years.
  - lalm 11y ago
    Why is there still a debate about whether the NSA have access then?
    - draugadrotten 11y ago
      Because misdirection. Who else have access. The FSB?
    - MichaelGG 11y ago
      The "debate" is whether the NSA has "direct access" via special backdoors, or just via law and/or espionage. For instance, people were going off on Google, til it turned out the way the NSA was accessing it was via tapping fiber lines- that doesn't scream "direct access" in a cooperative manner. Anyone who thinks the NSA can't reach MS is unaware how easy it is to turn people. The KGB turned FBI/CIA agents for years, for paltry sums. Said spies claimed their only motivation was money. The USG would be incompetent if they didn't have agents working for all sorts of companies. Between all their resources, it's possible the NSA has setup some way to copy all Skype messages. But I would be very surprised if Skype was knowingly sending all data to them voluntarily. MS has denied this, and it'd require a lot of people to be in on it.
  - lalm 11y ago
    Do they store video chats?
djm_ 11y ago
Everyone will be wondering what the 8 characters are and the BBC fail to mention it, so here we go: “http://:” http://:” (without the quotes) [1] [1] http://venturebeat.com/2015/06/02/these-8-characters-crash-skype-and-once-theyre-in-your-chat-history-the-app-cant-start/ http://venturebeat.com/2015/06/02/these-8-characters-crash-s...
- elisee 11y ago
  Looks amusingly similar to a bug found by fuzzing in rust-url (the url parser used by Mozilla's Servo) less than a month ago. https://github.com/servo/rust-url/pull/108 https://github.com/servo/rust-url/pull/108 (Not implying the two are related in any way)
- LiquidFlux 11y ago
  Android, iOS and Windows apparently fall victim, OSX does not. Clearing local logs does not resolve the issue, you'll redownload the logs from the server on launch, the culprit message needs to be deleted.
  - sancha_ 11y ago
    Is this an article summarizer bot?
    - LiquidFlux 11y ago
      Nope, I tend to go straight to the comments to HN and Reddit threads for context, criticisms, the likely important relevant information.
  - abarringer 11y ago
    My skype crashes on OSX when I try it. I have Skype 7.8(388) on OS X 10.10.3. My skype is now constantly crashing even though I haven't sent that in at least 10 minutes. Crashes about every three seconds. Edit: upgraded to skype build 391 and it no longer crashes.
Paul_S 11y ago
Parsing URLs is hard. Writing tests to find potential segfaults is easier.
- deleted 11y ago
  [deleted]
- pbhjpbhj 11y ago
  Web browsers seem to manage to parse URLs quite well. Doesn't this suggest that MS were doing something funky with the URLs or had some sort of code to operate on certain URLs differently? Why would simply linkifying break the whole app?
  - TazeTSchnitzel 11y ago
    > Web browsers seem to manage to parse URLs quite well. Somehow, I think web browsers' URL parsers might be a little bit more hardened...
    - pbhjpbhj 11y ago
      What happened to code reuse? Microsoft seem to manage to parse URLs in emails fine too. Is it really that hard a problem that one of Microsoft's most installed apps should find it impossible to do without crapping its pants??
  - TheLoneWolfling 11y ago
    Really? https://github.com/servo/rust-url/pull/108 https://github.com/servo/rust-url/pull/108
    - pbhjpbhj 11y ago
      That's a protoype browser engine rather than a product installed on millions of users devices. The fact that this relatively minor project found that parsing error through basic testing at prototype stage actually supports the position that Microsoft should have found this before. https://github.com/servo/rust-url/blob/1f08064eda8c2873bd64e0d092186cdd26ee1c4a/src/urltestdata.txt https://github.com/servo/rust-url/blob/1f08064eda8c2873bd64e... - has the string http:// http://: in at several places - are you telling me that MS wouldn't be expected to run similar test data against their URL parser in Skype prior to release?
reycharles 11y ago
Does this affect the Linux client?
- NamPNQ 11y ago
  No :d
- lalm 11y ago
  Nope
  - crdoconnor 11y ago
    Plenty of other bugs on the Linux client to make up for it.
lalm 11y ago
I think they're filtering messages through their server now. Half an hour ago it worked, now it says "message removed". Implying they MITM our messages and can censor them.
- SEMW 11y ago
  > Implying they MITM our messages and can censor them. Their ability to do this has been known for a while - see past HN discussions: - Https URLs posted in private Skype chats visited by Microsoft https://news.ycombinator.com/item?id=5704574 https://news.ycombinator.com/item?id=5704574 - Skype and Microsoft man-in-the-middle chats to give targeted ads https://news.ycombinator.com/item?id=7369163 https://news.ycombinator.com/item?id=7369163
- UnoriginalGuy 11y ago
  I remember back in the day pre-Microsoft when Skype was unable to do that because it had point to point encryption. Then Microsoft purchased them, killed the Skype P2P infrastructure which was a massive cost saver for Skype and instead had it use standard servers. People have claimed, without much evidence, that the NSA helped finance the purchase for Microsoft in exchange for making Skype easier to monitor but so far as I said nobody has solid PROOF of that, just speculation. But I will say what Microsoft did made little logical sense. The whole point of Skype was to make running a network inexpensive and scalable, Microsoft's changes made running Skype much more expensive (and what company WANTS a product to cost more to run?).
  - ygra 11y ago
    That change came in a time where Skype ran increasingly often not on PCs but rather mobile devices. And what tablet or smartphone user WANTS a chat application to consume excessive CPU and bandwidth while running in background? That's the official version, anyway. You may choose to ignore reasons giving by the people who made the change, of course. The infrastructure on which Skype was built relied on most clients being PCs with decent internet connections and CPU to spare. Something that's increasingly not true in today's world.

63 points by SimplyUseless 11y ago

lalm 11y ago

This raises an interesting point: Skype downloads your chat log from their server. They have your chat log on their server.

dragos2 11y ago
How else would you sync conversations across multiple devices? Let's not simply forget about the benefits of a decision.
- kissickas 11y ago
  I thought they used to only sync chat logs when multiple devices were online, until they switched from a P2P to a cloud-based model. http://blogs.skype.com/2013/10/04/skype-architecture-update/ http://blogs.skype.com/2013/10/04/skype-architecture-update/ http://www.makeuseof.com/tag/skype-enables-synchronization-of-chat-message-history-across-all-your-devices/ http://www.makeuseof.com/tag/skype-enables-synchronization-o...
meowface 11y ago
They have stored chat logs on their server for many, many years.
- lalm 11y ago
  Why is there still a debate about whether the NSA have access then?
  - draugadrotten 11y ago
    Because misdirection. Who else have access. The FSB?
  - MichaelGG 11y ago
    The "debate" is whether the NSA has "direct access" via special backdoors, or just via law and/or espionage. For instance, people were going off on Google, til it turned out the way the NSA was accessing it was via tapping fiber lines- that doesn't scream "direct access" in a cooperative manner. Anyone who thinks the NSA can't reach MS is unaware how easy it is to turn people. The KGB turned FBI/CIA agents for years, for paltry sums. Said spies claimed their only motivation was money. The USG would be incompetent if they didn't have agents working for all sorts of companies. Between all their resources, it's possible the NSA has setup some way to copy all Skype messages. But I would be very surprised if Skype was knowingly sending all data to them voluntarily. MS has denied this, and it'd require a lot of people to be in on it.
- lalm 11y ago
  Do they store video chats?

djm_ 11y ago

Everyone will be wondering what the 8 characters are and the BBC fail to mention it, so here we go: “http://:” http://:” (without the quotes) [1] [1] http://venturebeat.com/2015/06/02/these-8-characters-crash-skype-and-once-theyre-in-your-chat-history-the-app-cant-start/ http://venturebeat.com/2015/06/02/these-8-characters-crash-s...

elisee 11y ago
Looks amusingly similar to a bug found by fuzzing in rust-url (the url parser used by Mozilla's Servo) less than a month ago. https://github.com/servo/rust-url/pull/108 https://github.com/servo/rust-url/pull/108 (Not implying the two are related in any way)
LiquidFlux 11y ago
Android, iOS and Windows apparently fall victim, OSX does not. Clearing local logs does not resolve the issue, you'll redownload the logs from the server on launch, the culprit message needs to be deleted.
- sancha_ 11y ago
  Is this an article summarizer bot?
  - LiquidFlux 11y ago
    Nope, I tend to go straight to the comments to HN and Reddit threads for context, criticisms, the likely important relevant information.
- abarringer 11y ago
  My skype crashes on OSX when I try it. I have Skype 7.8(388) on OS X 10.10.3. My skype is now constantly crashing even though I haven't sent that in at least 10 minutes. Crashes about every three seconds. Edit: upgraded to skype build 391 and it no longer crashes.

Paul_S 11y ago

Parsing URLs is hard. Writing tests to find potential segfaults is easier.

deleted 11y ago
[deleted]
pbhjpbhj 11y ago
Web browsers seem to manage to parse URLs quite well. Doesn't this suggest that MS were doing something funky with the URLs or had some sort of code to operate on certain URLs differently? Why would simply linkifying break the whole app?
- TazeTSchnitzel 11y ago
  > Web browsers seem to manage to parse URLs quite well. Somehow, I think web browsers' URL parsers might be a little bit more hardened...
  - pbhjpbhj 11y ago
    What happened to code reuse? Microsoft seem to manage to parse URLs in emails fine too. Is it really that hard a problem that one of Microsoft's most installed apps should find it impossible to do without crapping its pants??
- TheLoneWolfling 11y ago
  Really? https://github.com/servo/rust-url/pull/108 https://github.com/servo/rust-url/pull/108
  - pbhjpbhj 11y ago
    That's a protoype browser engine rather than a product installed on millions of users devices. The fact that this relatively minor project found that parsing error through basic testing at prototype stage actually supports the position that Microsoft should have found this before. https://github.com/servo/rust-url/blob/1f08064eda8c2873bd64e0d092186cdd26ee1c4a/src/urltestdata.txt https://github.com/servo/rust-url/blob/1f08064eda8c2873bd64e... - has the string http:// http://: in at several places - are you telling me that MS wouldn't be expected to run similar test data against their URL parser in Skype prior to release?

reycharles 11y ago

Does this affect the Linux client?

NamPNQ 11y ago
No :d
lalm 11y ago
Nope
- crdoconnor 11y ago
  Plenty of other bugs on the Linux client to make up for it.

lalm 11y ago

I think they're filtering messages through their server now. Half an hour ago it worked, now it says "message removed". Implying they MITM our messages and can censor them.

SEMW 11y ago
> Implying they MITM our messages and can censor them. Their ability to do this has been known for a while - see past HN discussions: - Https URLs posted in private Skype chats visited by Microsoft https://news.ycombinator.com/item?id=5704574 https://news.ycombinator.com/item?id=5704574 - Skype and Microsoft man-in-the-middle chats to give targeted ads https://news.ycombinator.com/item?id=7369163 https://news.ycombinator.com/item?id=7369163
UnoriginalGuy 11y ago
I remember back in the day pre-Microsoft when Skype was unable to do that because it had point to point encryption. Then Microsoft purchased them, killed the Skype P2P infrastructure which was a massive cost saver for Skype and instead had it use standard servers. People have claimed, without much evidence, that the NSA helped finance the purchase for Microsoft in exchange for making Skype easier to monitor but so far as I said nobody has solid PROOF of that, just speculation. But I will say what Microsoft did made little logical sense. The whole point of Skype was to make running a network inexpensive and scalable, Microsoft's changes made running Skype much more expensive (and what company WANTS a product to cost more to run?).
- ygra 11y ago
  That change came in a time where Skype ran increasingly often not on PCs but rather mobile devices. And what tablet or smartphone user WANTS a chat application to consume excessive CPU and bandwidth while running in background? That's the official version, anyway. You may choose to ignore reasons giving by the people who made the change, of course. The infrastructure on which Skype was built relied on most clients being PCs with decent internet connections and CPU to spare. Something that's increasingly not true in today's world.