An Analysis of the Skype Protocol

zib writes "Ever felt a need to peek under the hood of your Skype client? This paper (PDF) explains all the details. Among other issues, it focuses on the NAT capabilities of Skype and audio compression."

Comments

Supernodes?

[gaber1187]

Interesting paper.

What is the deal with supernodes, isn't there a peer to peer protocol that doesn't revolve around supernodes? I don't like the idea of somebody setting up a high-bandwidth machine and routing enough packets to get the entire phone call I'm making and then in their spare time decrypting my phone call.

We need a a VoIP method that uses bit torrent and duplicates what you are saying many times, which wastes bandwidth but makes up for the slowness factor. And even still, we need a bit torrent less reliant on supernodes... could a VoIP network function on a P2P network meant to work without supernodes?

Somebody know more details about what the difficulties are in making a P2P network without supernodes? (Assuming there are lots of people on the network).

Privacy issues?

Re:Supernodes?

[awolk]

I don't like the idea of somebody setting up a high-bandwidth machine and routing enough packets to get the entire phone call I'm making and then in their spare time decrypting my phone call.

Well, I can't read the paper, because I don't have a pdf reader available, but I think they've done the crypto-stuff good enough, so that it's almost impossible to decrypt.
What is the point of decrypting something if it takes >100.000 years?

Re:Supernodes?

[Anonymous Coward]

You're going to need a pretty super node to decrypt 256-bit AES.

Re:Supernodes?

[Sanity]

isn't there a peer to peer protocol that doesn't revolve around supernodes?

Several. Freenet doesn't require supernodes, it is entirely decentralised, the same is true of Dijjer. Generally, a P2P application can use a Distributed Hashtable to find information without relying on a centralised server (neither Freenet nor Dijjer use a DHT, although their approach is vaguely similar).

Re:Supernodes?

[Thrakkerzog]

I don't think that your phone call data goes through the supernode. From what I understand, the supernode is used to facilitate the connection between two clients which are behind NAT or a firewall. After the supernode hooks you up, it is a direct connection between the two clients, without the supernode involved.

Re:Supernodes?

[kuwan]

What is the deal with supernodes, isn't there a peer to peer protocol that doesn't revolve around supernodes?

Because this type of tiered network is what works and scales well to thousands and millions of clients. The original Gnutella protocol was designed not to use "supernodes" or a tiered network structure and it was a miserable failure. The bandwidth and large latency required for all of the clients to communicate with each other (especially ones using 56K modems) easily overcame the usefulness of the network. The current Gnutella protocol now uses a tiered (layered) network where clients can become supernodes and this version actually works with tens to hundreds of thousands of people connected.

When creating a large, scalable network this type of protocol is what has been proven to work.

--
Join the Pyramid - Free Mini Mac

Re:Supernodes?

[Anonymous Coward]

They are not using a public key algorithm. That's a problem.

Re:Supernodes?

[Anonymous Coward]

That makes no sense.

Lets say I'm firewalled and you're firewalled. Neither of us can open any ports. I want to call you. As a result, we both connect to a supernode, and send and receive data through the supernode. The supernode sees it all.

Re:Supernodes?

[jd]

The problen with loading the network up is that you increase the latency (spare packets have to be processed enough to know to drop them) and you increase the packet loss overall (because if everyone does this, packet collisions will increase exponentially).

There are other solutions which'll do essentially what you want. One option is to have connections rotate round-robin style, rather than by bandwidth. That way, if you can go by 5 paths, each path gets 1/5th of the traffic, making it much harder for evesdroppers.

A second option is to use kernel or userland IPSec, so that all connections are secure. IPSec is pretty solid and it is doubtful anyone would be able to break into such traffic.

Supernodes are just a load-balancing mechanism. Not a very good one, because it's a two-state system, but it works. Networks have developed routing and QoS protocols to handle exactly the kind of information P2P is approximating with the supernode scheme. It would seem to make much more sense to use mechanisms people have worked on for much longer to get right.

Re:Supernodes?

[johnjaydk]

In a scenario with two Skype(tm) clients behind NAT firewall/router/whatever that blocks UDP (ie. only allows TCP) I'd really like to hear how you set up a direct connection between the two clients.

At the very least; In the connection setup the third-party (ie supernode) has to open a server socket that both clients connect to using client sockets. The supernode then forwards information between the two.

Now what type of magic is used to hook up a direct connection between the two clients ? TCP connection hi-jacking ? This scores high on my bullshit-o-meter.

Re:Supernodes?

[Anonymous Coward]

For one thing, if you're going to do UDP hole punching (to connect two NAT'd clients), you'll need some intermediary node to set up the connection for you. Otherwise, the clients can't directly negotiate a connection.

Second, as others have already mentioned, supernodes should only be routing the connections, not routing the actual bits in the call.

Re:Supernodes?

[gaber1187]

Man, I know it... I used the original gnutella, and man it was soooooo slowwwww... I agree... I think what somebody else said above is possibly correct that the nodes are only used to make the connections, once data starts flowing, it all goes through the normal ip routes...

Re:Supernodes?

[bigberk]

Not necessarily. There exist ways to get through a double NAT environment. We developed one such system for an engineering thesis; for documentation on another see the "STUN" RFC

Re:Supernodes?

[cyberfunk2]

The problem without supernodes, at least as I understand it is speed. Simply put, most nodes on the network have limited upload bandwidth (eg: cable modems, where upload caps are but a fraction of the down caps)

Without supernodes and their ability to push data quickly you get stuff like freenet or MUTE. While these are much more privacy oriented, there's a reason they're not mainstream: They dont rely on high speed connects, and thus cant provide high speed service.

As Skype is a legally oriented service on the whole (it's not really used for trading MP3s/movies/etc) I think that they wont really have legal problems w/ the supernodes as other networks (read: Kazaa, et al.) might have.

As to privacy concerns, 256 bits is pretty strong, and sure, the NSA might have an interest in tapping your calls, but, if that were the case, I think they'd have better ways of doing it anyways (ie: sneak and peak monitoring).

Not too much to worry about, but an interesting paper on the ideas behind the protocol.

Re:Supernodes?

[cyngus]

Yes you could build one without supernodes, but this is a bad approach. To build the best P2P network you need to build the best overlay network (a logical network that operates on top of the physical one). The best way to do this is to assign nodes addresses based on their resource availability, primarily we're concerned with processing power and bandwidth and, depending on the application, latency to other nodes. If you properly address all nodes things turn out great. You can then use distributed routing tables to guarantee delivery within a certain number of hops, typically log n. Now, in practice developing good address is incredibly difficult because nodes may come and go and nodes may arrive that, according to your address assignment algorithm, have the same address as existing ones and their for some sort of address reassignment needs to occur.

But I'm getting too deep. Supernodes are a very simple approach at resource-based addressing. Basically nodes with good connections (fast and low latency) to many other nodes become super nodes. You want super nodes, they make the network better.

Re:Supernodes?

[cyngus]

The problem is that QoS-aware protocols are not universally deployed, so you can't count on them. Additionally most of the router-based QoS protocols suck. Adding "smarts" to the network infrastructure goes against the original Internet design principles, which dicatated that the network should be as dumb as possible and add the smarts to the end hosts.

Re:Supernodes?

[drew]

i've seen someone experimenting with this before. it's actually not too difficult to do once you have two computers that are both trying to set up the connection. how to alert the second computer that the first wants to initiate a connection is the challenge. in this case the supernode seems to be responsible for that aspect.

basically each computer attempts to initiate a connection to the other computer on a port that has been agreed to in advance. the first computer to attempt will fail, due to the firewall on the other end. however, his firewall will now be expecting return traffic originating from the port that his computer attempted to connect to. therefore, the second connection attempt, from the other computer, will succeed. now, both firewalls are allowing return traffic through in response to a connection initiated from inside the firewall. all the supernode has to do is allow for negotiation of timing and source and destination port numbers, and the rest is quite simple.

Re:Supernodes?

[Stween]

"Somebody know more details about what the difficulties are in making a P2P network without supernodes?"

It's not difficult, but the issue is scalability. To have a P2P network scale, you have to have some efficient network structure for shunting data around. Efficient is a relative term; robustness might be the goal here with supernodes.

For implementations of distributed hash tables, bandwidth certainly isn't the main concern, so those are logically constructed generally without any concept of a supernode. The issue on a DHT is to achieve an efficient number of overlay hops from any one node to any other no matter how many members are in that DHT space.

When you're conferencing calls and numerous people are sending/recieving data, it simply makes sense to try and push lots of data through fat pipes, and less data through thinner pipes. This means that any P2P overlay designed to facilitate conferencing applications should place peers with high bandwidth/low latencies to others in positions whereby the inevitable duplication of packets (compared to IP Multicast) doesn't hit it quite so hard as the poor guy sitting on a 56k modem in the UK while the rest of the conference is on fast connections in the US.

It's been about three months since I read this Skype paper, so I can't quite remember where the supernodes are used. I think my description above will apply to the way it constructs its overlays for conferences themselves, but supernodes are elected to maintain whatever structure they have in place for lookups on usernames.

My current work involves writing an open-sourced implementation of a P2P protocol which allows conferencing applications to be built on top; I've looked at lots of protocols. The protocol which I am implementing will theoretically scale only to groups of size ~100 (for the conferencing itself; there's no reason a lookup mechanism could be run alongside, which is undoubtedly what Skype is doing in some sense).

The code will be released on sourceforge when I can think of a good name.

Re:Supernodes?

[acaspis]

however, his firewall will now be expecting return traffic originating from the port that his computer attempted to connect to. therefore, the second connection attempt, from the other computer, will succeed

Interesting, but I wouldn't expect this technique to defeat anything else than trivial "personal firewalls". Any NAT between the two computers would alter the calling ports and break your assumptions.

Has anyone actually tried this ?

Re:Supernodes?

[Rei]

Supernodes aren't the only way, though. I like the concept of a Kademlia-style network. If you have a definitive routing order, you don't have the problem with requests looping back and staying within a small group of peers like they did on Gnutella. That, more than anything, was its fundamental flaw. To try and overcome this, you have to increase the number of hops; this, combined with the latency, is disastrous.

I've proposed a modification of the basic concept to the kenosis group; we'll have to see where it goes. One of the weaknesses of a Kademlia style network is that neighboring nodes will be scattered across the planet from each other, increasing latency. The solution that I propose is to create broken loops in class A or even class B subnets and link them end to end. That way, you don't have every last request bouncing across the entire globe.

More than network performance, I'd be more concerned with content pollution and anonymity (and their respective solutions - moderation/metadata, and limted proxying or source/destination spoofing, respectively).

Re:Supernodes?

[Rei]

Strangely, when I was reading the article, they made it sound like they were proxying the data. Here, let me quote:

"For the third setup, in which both users were behind port-restricted NAT and UDP-restricted firewall, both caller and callee SC exchanged signalling information over TCP with another online Skype node. Caller SC send media over TCP to an online node, which forwarded it to callee SC over TCP and vice versa. The message flow is shown in Figure 11.

There are many advantages of having a node route the voice packets from caller to callee and vice versa. First, it provides a mechanism for users behind NAT and firewall to talk to each other. Second, if users behind NAT or firewall want to participate in a conference, and some users on public IP address also want to join the conference, this node serves as a mixer and broadcasts the conferencing traffic to the participants. The negative side is that there will be a lot of traffic flowing across this node. Also, users generally do not want that arbitrary traffic should flow across their machines."

Re:Supernodes?

[drew]

i had a friend who did some brief experiments to prove it could work but never got much further than that. a while back i saw a program on freshmeat that performed this task for arbitrary clients, which i believe used udp to perform the timing/port negotiations (so it would only work behind firewalls that allowed udp). i personally never actually tried it, but he had a site up explaining the mechanics, and stated that he had been successfully using the method for a while.

Re:Supernodes?

[Mantorp]

What is the deal with supernodes?

Is Jerry Seinfeld posting on slashdot now?

Re:Supernodes?

[superpulpsicle]

Yeah I wish there was some noobish tutorial for Skype(tm) clients behind NAT firewall/router. It's one thing to explain mechanics, it's another to see it step by step.

Re:Supernodes?

[Anonymous Coward]

"Distributed Sloppy Hash Table"; already deployed in a big app; see Coral.

There's also a form (codenamed "dancing hashtable") which shifts nodes around in such a way that nodes with mutual low latency to each other have low distance metrics, but I won't cover it here because it isn't published yet.

Re:Supernodes?

[acaspis]

I went through the paper and it suggests that whenever one of the two Skype clients is behind a firewall, traffic will flow through a supernode.

So, no fancy firewall-piercing here. And that's not even optimal: there are other cases where traffic could be direct (and only signalling would need to go through a SN).

Re:Supernodes?

[Rei]

Interesting... I ran into a paper about how Coral does clustering, and they did something that I didn't even think of - have varying diameters of clusters. Indeed, that should allow for content to migrate very effectively if you've effectively got completely different sets of "neighbors".

About the dancing hash table - implementation issues aside, isn't that a rather significant risk for malicious clients? I mean, restricting people to the same class A or B subnet is one thing, but if low latency is your criteria, it would seem that malicious clients could simply add an artificial delay in responding to packets except for the machine that they want to surround, and then cut it off from legitimate clients. You couldn't do that if you were just restricted to the same subnet but had an otherwise seemingly "random" hash ordering.

Re:Supernodes?

[Afrosheen]

You're talking about issues with the SIP protocol and double NAT. Other, newer protocols like iax and iax2 don't have problems with double NAT. The only problem is, nobody makes IAX/IAX2 phones (yet). People are working on them. In the meantime the little iaxy bugger from Digium is supposed to fill the gap, at least with standard analog phones.

Re:Supernodes?

[yppiz]

basically each computer attempts to initiate a connection to the other computer on a port that has been agreed to in advance. the first computer to attempt will fail, due to the firewall on the other end. however, his firewall will now be expecting return traffic originating from the port that his computer attempted to connect to. therefore, the second connection attempt, from the other computer, will succeed. now, both firewalls are allowing return traffic through in response to a connection initiated from inside the firewall. all the supernode has to do is allow for negotiation of timing and source and destination port numbers, and the rest is quite simple

I think Safeweb's Triangle Boy proxy client used this method, but for the purpose of getting through national firewalls (China, Saudi Arabia) rather than local ones.

For a time, anyone could download this client, but now, all I can find about it are old links and this Internet Archive copy of the Triangle Boy whitepaper.

If anyone is maintaining the source, please let me know.

--Pat / zippy@cs.brandeis.edu

Re:Supernodes?

[aminorex]

> I'd really like to hear how...

Simultaneous SYN.

Skype does not use it.

other VOIP providers?

[Anonymous Coward]

So does Skype do things any differently than the other VOIP providers?

Does this info also apply to Vonage? Broadvoice? Callvantage?

Or do they all have their own proprietary protocols?

Re:other VOIP providers?

[Organized Konfusion]

other voip providers use a something called Session Initation Protocol which is an open standard, compatable with loads of clients even open source ones like kphone.
Even the routing can be done with open projects such as Asterisk. Skype is worthless proprietary tripe compared to these solutions.

Re:other VOIP providers?

[leonscape]

I do think your wrong about it being tripe and useless. Skype will will succeed, and be around for quite a while.

Simply because it is so damn easy to use, It has clients for Windows, Mac OS X and Linux, and all you need is the ID of anyone you want to call. No screwing around.

I ain't no fan boy, but after using SIP and Skype, I know which the majority of users are going to find easier to use.

Also check out http://www.ilbcfreeware.org/ for the codec.

Re:other VOIP providers?

[Pxtl]

Agreed. I'll believe in SIP when I see a free client for it that's anywhere near as good as Skype. Skype is the only "just works" cross-platform voip solution I've ever seen. Hell, even MSN voicechat is unusable on older versions of Windows since only new versions of windows support the newer versinos of MSN that have NAT traversal.

Re:other VOIP providers?

[jacksonj04]

However, what most VoIP solutions seem to lack is the idea that you can install them and 'phone' an IP address. You still need a number, it still traverses over POTS for the most part, and it usually costs. Skype just works over existing networks, and whilst I'm no fan of locking people into one solution Skype does actually work.

Re:other VOIP providers?

[DarthBart]

They all run at least SIP. But with them, there is very little reason to try to work on a peer to peer connection since 95% of their traffic is going to terminate over the PSTN, not to another IP phone.

But, even with that, there is a feature in SIP called "REINVITE" in which two SIP endpoints can renegotiate their media stream paths to send their audio directly to each other and only send call progress messages to the original server (for billing purposes, mainly). Reinvite really only works well if both endpoints are not behind NAT, though and there is an issue with compatibility between vendors.

Re:other VOIP providers?

[PhilK]

Once again someone who knows nothing randomly sprouds garbage.

SIP works reliably *if* and *only if* there are no NAT gateways anywhere. Honest. Unfortunately that doesn't describe the majority of the world.

Skype works anywhere. When you come up with a free solution that works as well, feel free to bag Skype. That day is still a long way off.

How future proof is this?

[Samir Gupta]

I believe the NAT traversal is done by routing via super-nodes which are not behind a NAT or firewall. Is this a valid assumption for the future? In other words, what if every host is behind a NAT or firewall -- it seems that way, given the increased security conciousness of hardware and software makers, that sometime in the near future, firewalling will be the norm and default, not the exception?

Re:How future proof is this?

[PigleT]

Roll on ipv6. No NAT, everyone with a public IP#. Fine by me.

Re:How future proof is this?

[Rikus]

I imagine anyone dedicated enough to run a supernode probably has the resources to run other types of servers as well. Even if they are using a firewall, it's not going to just block all incoming connections. If this type of "increased security consciousness" affected everyone, web servers wouldn't work either.

Re:How future proof is this?

[Anonymous Coward]

IPv6 wont stop NATs being deployed ,they will just be updated to support IPv6.

Re: How future proof is this?

[Alwin Henseler]

I believe the NAT traversal is done by routing via super-nodes which are not behind a NAT or firewall. Is this a valid assumption for the future? In other words, what if every host is behind a NAT or firewall

It looks like (I'm not sure) the Skype protocol routes voice data through non-firewalled nodes when at least one of the endpoints is firewalled. In theory, you don't need to do this. To establish a call, you may need a non-firewalled node if the node being called is behind NAT or firewall. Once contact is made, only one of both nodes must be non-firewalled to exchange data directly.

The only problem is when BOTH endpoints are firewalled. If one of these has control over the firewall (like when it's a software firewall running on the client's PC, or a router box in the home of the user), it can be adjusted to allow for the Skype client traffic -> problem solved.

Only when both endpoints are behind firewall or NAT, AND neither can adjust firewall settings, it's necessary to route voice traffic through other nodes. When properly encrypted, that's just a bandwidth issue. Quoting from the PDF: "Thus, the total uplink and downlink bandwidth used for voice traffic is 5 kilobytes/s. This bandwidth usage corresponds with the Skype claim of 3-16 kilobytes/s."

So bandwidth needed for voice traffic is low, and may decease as voice compression gets improved. A node on a fast link (like cable modems today) could route many calls, and only needs to route data for clients that are currently 'on the phone'. Specialized gateways to the POTS (classic telephone) will surely be set up in way that's easy for clients. With connection speeds upgraded all the time, and always some machines not firewalled or behind NAT, I don't see much of a problem here.

Re: How future proof is this?

[Alwin Henseler]

Roll on ipv6. No NAT, everyone with a public IP#.

You mean because IPv6 increases the IP address space enough so that every single refrigerator, phone and toaster can have its own (public) IP# ?

Bullshit. There are many reasons to use NAT, saving IP addresses is only 1 of these. And AFAIK, there isn't a real shortage of IP addresses yet. If there is, it's because they're not distributed/used well, not because there aren't enough of them.

Re: How future proof is this?

[Anonymous Coward]

You mean because IPv6 increases the IP address space enough so that every single refrigerator, phone and toaster can have its own (public) IP# ?

Let's put it this way. There are:
340,282,366,920,938,463,463,374,607,431,768, 211,45 6 IPv6 addresses (2^128).

So, yes. Everything can have an IP address on this planet.

Re: How future proof is this?

[rbarreira]

Only when both endpoints are behind firewall or NAT, AND neither can adjust firewall settings, it's necessary to route voice traffic through other nodes.

Unless NAT2NAT techniques are used. Yes, it requires a non-firewalled intermediate node, but just to start the connection :)

Re:How future proof is this?

[azknom]

NAT traversal is indeed one of the major challenges for IP telephony. Skype solves this by using supernodes without NAT to bridge traffic between two NATed clients. If you look on a regular SIP scheme it does not use such nodes but rather communicates directly between two clients. The only thing a SIP server does is to handle connectivity information. The problem here is that NATs and firewalls mess things up pretty bad. It is possible to solve with SIP aware NATs but there are still few of those out there.

More information on internals..

[Anonymous Coward]

You can get in on the existing conversation about this paper Here

Bad start

[Sanity]

Skype is a peer-to-peer VoIP client developed by KaZaa...

KaZaa isn't a company, it is a piece of software. Skype was developed by the same guys that were behind the KaZaa software, but not (to the best of my knowledge) by the company that now owns KaZaa.

Re:Bad start

[Sc00ter]

This is slashdot, what do you expect.

Re:Bad start

[Anonymous Coward]

Well, this page says one of the founders was "the CEO of KaZaa", so it really sounds like a company, no?

Skype Banned

[Realistic_Dragon]

Do you really want to be running Skype or let it onto your network? At my university Skype has been banned. Here is the reasoning:

Skype Peer to Peer Telephony software is now also prohibited. Skype is a
free application that facilitates free telephone calls through the use of
an internet connection.

Calls made using the system are directed through 'Supernodes', which can be
ordinary PC's with Skype installed. Machines on fast and well connected
Internet feeds like the $Network are likely to automatically become
'Supernodes' and forward a considerable amount of traffic.

This allows Skype to route other peoples Voice over IP calls using your
machine and the university internet connection. This is in breach of the
Acceptable Use Policy and could potentially put the university's network
and core business at risk.

Finally, the Skype End User License Agreement (EULA) grants Skype permission
to install and use 3rd party software on computers running Skype. This could
include an array of spyware and adware that is likely to threaten the
privacy of anyone installing this software.

Re:Skype Banned

[JJahn]

I checked out Skype's EULA as found on their website.

The only thing relating to third party software that I found was this:

2.4 Third Parties. You acknowledge and agree that the Skype Software may be incorporated into, and may incorporate itself, software and other technology owned and controlled by third parties. Skype emphasizes that it will only incorporate such third party software or technology for the purpose of (a) adding new or additional functionality or (b) improving the technical performance of the Skype Software. Any such third party software or technology that is incorporated in the Skype Software falls under the scope of this Agreement. Any and all other third party software or technology that may be distributed together with the Skype Software will be subject to you explicitly accepting a license agreement with that third party. You acknowledge and agree that you will not enter into a contractual relationship with Skype or its Affiliates regarding such third party software or technology and you will look solely to the applicable third party and not to Skype or its Affiliates to enforce any of your rights.

Basically, you have to explicitly accept a license agreement with the third party. They say nothing in here about installing and using 3rd party software on your computer without your consent.

Re:Skype Banned

[pVoid]

Yeah, but you don't understand what network topology means if you think peers' nodes will be used to relay data.

Generally speaking, end users are at the very bottom of a long hierarchy of ISPs and pipes. For example: UUNET -> AT&T -> Your local ISP -> You. As such, generally speaking, you are a leaf on a very large tree that may span several classes of IP networks. If a peer were to be used as a super node, it would mean that the data send from A to C would travel like this: A -> ISP -> AT&T -> UUNET -> Verizon -> Bell -> ISP -> B -> ISP -> Bell -> Verizon -> SomeOtherCarrier -> SomeOtherLocal -> ISP -> C.

It makes no sense since in all likelyhood, UUNET, Verizon and SomeOtherCarrier are all on the same backbone, one or two hops away from each other.

It only makes sense in a LAN situation, like in Campus setups where there are nodes that are 'above' other nodes hierarchically: like if someone has inbound Internet over one box and distributes the connection to his dorm house connected to 8 other computers.

And aside from that, Skype coms are encrypted. No third party software can intercept a properly encrypted message. That's the whole point of PKI, to avoid man in the middles.

Re:Skype Banned

[grazzy]

a troll a day keeps the insanity away.. ?

Re:Skype Banned

[Anonymous Coward]

Troll? Check the facts first.

Re:Skype Banned

[tod_miller]

Sorry for the spanner, but I hardly doubt someone is routing packets all the way thorugh your uni's connection to make a phone call.

Latency dude.

p2p and torrent technology is the worst network framework for something like streaming audio (lets not fuck ourselves with words like voice-over-ip... it is audio, and a network, and it streams...)

p2p could just mean point 2 point for all you care. It makes a direct connection to the dudes place machiney thingy, else it wouldn't work.

Re:Skype Banned

[WolfWithoutAClause]

It makes no sense

Um, actually RTFA.

In most cases the voice packets go direct leaf node to leaf node.

However if both are behind NAT firewalls then they can't directly talk to each other, and the Skype protocol seems to pick another Skype users machine (picked by some scheme that probably isn't publically described anywhere) and route the packets through them.

There's no security problem with doing this (the packets are end-end encrypted), it just takes longer and is more likely to congest, and it takes up bandwidth at the extra users network.

Really, IMNHO, NAT is a real menace. I'm really looking forward to IPv6 which doesn't have all this garbage; should be here by 2100 I reckon.

Re:Skype Banned

[pavon]

Yes, it would be nice if you didn't have to go down into the leaves, however, UUNET does not have Skype installed. Nor does the telco or your ISP. Only Skype users have the skype supernode software installed and so only they can act as supernodes.

This is horribly inefficient, however it is only used if you are behind a firewall or NAT and don't have have the necissary ports open. If you (or the person you are talking to) is on a publically routable IP address then Skype will just make a direct P2P connection with the other client. Which leaves you with a choice. If you block that port on your firewall, then you will have to go through a supernode every time you call someone else that is also behind a firewall. If you leave those ports open then you will never have to go though a supernode, but you may end up acting as a supernode for others.

Re:Skype Banned

[Chanc_Gorkon]

This is teh best explanation of this I can see. I was not aware of the Supernode issue. BUT I can see where this would be a hassle. I wonder if one can change the firewall to only allow outbound coms on the skype ports. That way you would not be useable as a supernode. Also, it seems, to me, that they should make that as a setting in Skype to NOT allow yourself to be a supernode. That should only be allowable if you don't have to use supernodes (ie your ports are open properly).

Re:Skype Banned

[jcbeckman]

Last week the EULA on their website didn't match the one that popped up during install. The one during install was different in this very section, saying nothing about "improving technical service" as a reason for installing 3rd party software.

Re:Skype Banned

[Anonymous Coward]

RTFA! Skype does route calls through supernodes, because sometimes there is no other way to get the call through.

Re: Skype Banned

[Alwin Henseler]

Skype emphasizes that it will only incorporate such third party software or technology for the purpose of (a) adding new or additional functionality (..)

Well, that would cover addware or spyware; like it or not, one could just call it 'added functionality'.

Any and all other third party software or technology that may be distributed together with the Skype Software will be subject to you explicitly accepting a license agreement with that third party.

Sounds decent enough, but makes many -weak- assumptions:

• That users actually read these licenses (they don't)
• That users will decide 'No' if they don't like it (no they won't, they'll just click 'Ok' on any dialog encountered during install)
• That company is honest, and will act according to the license conditions (maybe it will, maybe it won't, can you tell?)
• That license read on website is same as the one included in the installer
• That users will notice if license conditions are changed (probably not)

So basically, this is food for lawyers. Other than that, I'd put more faith in companies' reputation, previous track record, or some insight into why they distribute the software.

Re:Skype Banned

[Anonymous Coward]

Yes, that's exactly how it works and why everyone with a clue thinks it's so stupid.

Re:Skype Banned

[Anonymous Coward]

But IF you have the ports firewalled out that is BECAUSE you (or your admin) specifically did not want this services, since it may constitute a security threat.

When you change your mind, open the ports instead of deploying insecure software designed to penetrate your firewall.

Re:Skype Banned

[arkanes]

It's not streaming because it's bi-directional - latency is actually a fairly minimal concern for streaming, assuming you've got enough bandwidth for a big packet. It's a really big deal for VoIP because you need to respond in a reasonable amount of time to what the other person is saying. That's why we don't call VoIP streaming audio - they have different characteristics. P2P works fine for streaming, except that BT (for example) is less efficent when you require parts of a file to come in order.

Re:Skype Banned

[Anonymous Coward]

Your looking forward to something you don't expect to be fully used for another ~95 years?

Don't tell me you buy into those crazy peoples scemes of extra long life. :P

Re:Skype Banned

[pVoid]

Read the fucking post, if you are both behind a NATed firewall, you fall into the description that I gave: on a LAN, where several computers are situated on several levels of hierarchy.

So what if a box behind a nat is forwarding even two conversations on LAN. It's probably going to use up .5% CPU, and the LAN traffic won't increase or decrease since it's arleady on a LAN.

Your point?

Re:Skype Banned

[WolfWithoutAClause]

Your point?

My point- dumbass- is that if they are behind *different* NAT firewalls (actually routers). Then they specifically *do* send messages from A to B to C; something that you said "makes no sense".

And the protocol has to do that because NATd boxes can't ordinarily accept incoming connections (atleast not without the administrator doing lots of prior manual set-up on the NAT router). So point B has to be chosen from the set of non NAT'd IP addresses.

Re:Skype Banned

[pVoid]

So, "Dumbass", you're saying that if I'm behind a NAT, and you over there are behind a NAT, Skype is going to establish a connection to you through me? No.

The whole point of "through me" connections is that the NATed box and the recipient box are on the same internal network.

How old are you? Your tone of voice and lack of understanding of networks is highly indicative that you are a freshman that thinks they got the whole world figured out.

Re:Skype Banned

[Anonymous Coward]

Ahh, why don't you get fucked cuntass

Re:Skype Banned

[WolfWithoutAClause]

So, "Dumbass", you're saying that if I'm behind a NAT, and you over there are behind a NAT, Skype is going to establish a connection to you through me?

Wrong. LOL. I'm saying it gets routed through a third party.

The whole point of "through me" connections is that the NATed box and the recipient box are on the same internal network.

Wrong.

Your tone of voice and lack of understanding of networks is highly indicative that you are a freshman that thinks they got the whole world figured out.

Wrong, wrong, wrong! ROFLMAO.

Seriously, just read section 4.5 of the document you've evidently never, ever read and quit making an ass of yourself.

Windows registry? what's that?

[froggero1]

Skype stores its buddy information in teh Windows Registry. Buddy list is digitally singed and encrypted.....

Strange, I have it installed on my linux machine... and it doesn't have a windows registry... guess I dont have the capability of storing a buddy list.

Re:Windows registry? what's that?

[KyleJacobson]

I heard they install their "spyware" in your windows registry too......

/looks around scared

I better run home and delete my windows registry... I dont want them spying on me

Good riddance asswipe

[Anonymous Coward]

let me put a boot in ya sorry ass to hasten your departure

bye bye

[maztuhblastah]

Protocol analysis? I'll analyze that linking to a PDF will give us a chance to analyze a slashdotting.

One Cell Phone to Rule Them All

[MrAsstastic]

Where is the cell phone that utilizes this technology to replace international satellite phones? I noticed Skype needs 2kb u/d for "reasonable quality"... BTW - How can we be sure this would be used for Good and not Evil?

Re:One Cell Phone to Rule Them All

[Anonymous Coward]

No one would actually use something like Skype for a phone network. I don't want my phone calls being routed through untrusted nodes, no matter how much encryption is applied. It's just dumb.

Congratulations, Mr President

[Anonymous Coward]

Keep up the great work in the fight for freedom. Crush your liberal enemies.

Re:Congratulations, Mr President

[hey]

Yeah, good job making friends:
Child appears unhappy

[OT]: Re:Skype Banned

[ComputerSlicer23]

This is in breach of the Acceptable Use Policy and could potentially put the university's network and core business at risk.

Okay, I understand the whole AUP piece. I understand that it could be a problem for the network.

What I'm not sure I understand, is how a simple program could "put the University's core business at risk". If that is a publically funded University, I really object to that statement (it's not a business, a public service. It's nice if it's self funding, but the objective it not to turn a profit), if it's a private University I suppose it is in fact a business. I really don't see how this will in any way interfere with teaching students and colleting fees. While I suppose the degradation of internet service and the raising of ISP charges would affect the bottom line, it surely doesn't affect the ability of the facaulty to interact with students.

Kirby

Re:[OT]: Re:Skype Banned

[Anonymous Coward]

Hmm, well @ my university (I'll use another example and get back in a sec), there was the posibility of a Lawsuit against Blizzard with their WoW updater/downloader thing because it did the bittorrent transfer (although it would drop to http or ftp if that failed after a while).
Reasoning: Blizzard makes money on the product, the univeristy network says it can't be use for monitary gain (in the sense of another business using the school's network to make money). Because Blizzard was using univeristy connected computers (be them student or otherwise) to distribute (uploading in this case) the software it became illegal.

Now for Skype it looks as if they might be having that same problem. I see they can charge you to connect to normal phones, if those get routed through a student's computer you have the same problem.

They might also not like machines using "excessive" bandwidth that would posibly occur when using the Skype if they got bumped to Supernode status.

Re:[OT]: Re:Skype Banned

[great om]

A univerity's other core business is performing research in various fields of knowledge, many of this research requires internet/network connections.
Skype could concievably interfere with the relability and speed of these connections

Re:[OT]: Re:Skype Banned

[aminorex]

No, it can't: BitTorrent already ate the Internet.

Re:How to Get a Free Mac Mini!

[octaene]

What the f*** is this bullshiat doing on Slashdot?

Worst thing about Skype. . .

[aarku]

The program can automatically elevate itself to a Supernode and start chewing bandwidth. Not only that, but it alerts your friendly University system administrator that you may be "sharing copyrighted materials with Kazaa" and you have them frowning at them (and randomly shutting off your port because they believe you have been "hacked") Just use a different free Internet Telephony application.

Re:Worst thing about Skype. . .

[alirano]

You can easily avoid becoming a Supernode by not permitting incoming connections to the port Skype has opened for itself. The downside to this is that your calls will now be routed to another supernode, but if you're paying for bandwidth, there may be no way around that. You can still place and receive calls, and the added latency is not worth mentioning in most cases.

If you run Skype on Linux or Mac OS X, it is reduced to using high ports anyway, so it's easy to block. An example iptables command line would be

iptables -A INPUT -p tcp --dport 1024: --syn -j DROP

(Caveat: Check your local servers, use passive FTP, modify this if you actually want to use P2P, etc.)

Re:Worst thing about Skype. . .

[rikkus-x]

Just use a different free Internet Telephony application.

Any suggestions for one that is as easy to set up as Skype, has clients for Windows, Linux and MacOS and is open source?

I like gnomemeeting on Linux, but it isn't ported to Windows or MacOS, AFAIK.

Rik

Re:Worst thing about Skype. . .

[aminorex]

It doesn't have to be ported because it interoperates with other software by virtue of using a standardized protocol. Netmeeting on Windows does the trick. Ohphone worked on Mac when I last looked there. Probably gnomemeeting would via fink.

Re:Worst thing about Skype. . .

[john_prog]

OpenH323 Project in http://www.openh323.org/ is available on Windows and Linux platforms, plus there is source code. From the site: ...also compile on Windows 95/98, BeOS , Linux PPC, FreeBSD x86, OpenBSD x86 and Solaris Sparc & x86.

I don't actually know how well it performs but at least it is open source and probably doesn't hog your bandwidth with some supernode technique.

Why would it route through machines?

[glrotate]

Wouldn't a series of router hops generaly be the most direct route?

Re:Why would it route through machines?

[Stween]

Not when you're constructing a P2P overlay which reduces the amount of duplicated packets sent.

When multicasting data, you reduce the number of packets sent by building a distribution tree between nodes, which either all users share, or have one rooted at each source in the conference. There are many, many ways of doing this, but the end-result is the same. This tree is on the overlay level -- the routers have no knowledge of it. To forward packets across the overlay, they have to be pulled up to the application layer, then subsequently sent on their way.

The distribution trees are built using plain old IP Unicast to carry data, simply because IP Multicast never really made it in the real world (for a variety of reasons). In fact, the reason that things like Skype (and all recent previous works) exist, is because IP Multicast never really made it.

Non-Windows stuff

[JohnQPublic]

FYI, if you want to look at the "registry" info for Skype on Linux, it's in $HOME/.Skype/shared.xml.

Re:Non-Windows stuff

[Anonymous Coward]

See! I knew it! Linux DOES have a registry!

Re:Non-Windows stuff

[JohnQPublic]

See! I knew it! Linux DOES have a registry!

It sure does! And the Elektra Project even admits it!

Don't knock it.

[Facekhan]

Proprietary or not, it works and its easy to use. Skype does a lot of things differently than SIP. 256 bit AES encryption is strong enough to protect your data well into the near future.

It uses very little bandwidth and those Universities who are banning the software are just kneejerking to a new technology, just showing how far from the academic mission of research and experimentation most colleges have gone. Even more telling is how most Colleges charge exorbitant fees for local and long distance phone calls from student dorm phones. Why would they want to allow a technology onto their network that will mean less money going into their pockets.

As to the bandwidth issues, I think they greatly exaggerate the bandwidth use of a Skype supernode in order to justify their kneejerk reaction to any new technology on their network that does not come with a 3 year agreement with Dell and Microsoft.

Re:Don't knock it.

[damyata]

Indeed - we were explicitly banned from using any VoIP on our halls network.

Re:Don't knock it.

[alirano]

I've seen one Skype supernode in action and was pretty impressed by the bandwidth it was using. It was getting more than 15000 connections an hour, coming close to saturating its 100 mbps pipe. Which is kind of okay if you're paying a flat rate for access, but if you're paying by volume, I suggest that you take measures to avoid becoming a supernode. It's easy enough to do so. (On Linux, just block the high ports you're not using yourself. On OS X, activate that firewall.)

Re:Don't knock it.

[Espen]

Even more telling is how most Colleges charge exorbitant fees for local and long distance phone calls from student dorm phones.

Don't all Colleges have free long-distance as a cost-saving measure: Dartmouth Ends Billing for Phone Calls

HTML Google Cache

[Anonymous Coward]

Tada:
Google's HTML version

Any more docs like this?

[PetoskeyGuy]

NAT tranversal is great, and Skype is nice an solid. We're adding this to our next product. Does anyone know where I could find more documents like this?

200 Mhz

[fist]

Did anyone else notice that their test machines were 200 Mhz Pentiums running Windows 2000.

I bet they couldn't only see 5kbytes of traffic because that's all those poor machines could pump out!

Re:200 Mhz

[Anonymous Coward]

I would have liked to have seen a report on the Mac ver of Skype. IE: Mac's don't have "registries", so how do the Mac's deal with this.

I can knock it if I want to...

[harmless_mammal]

Any organization that want to "manage" their network infrastructure will make policy decisions about what is and isn't an acceptable use.

Bandwidth costs money, period, and you have to prioritize if you have a fixed budget. For Universities, the goals are research and education. That's what the network is there for. Are you learning anything by using Skype? No. Is it advancing research? No.

It's not YOUR network, get over it.

Re:I can knock it if I want to...

[Facekhan]

I hear this argument all the time and I have heard it when I worked on a .edu network. I always say the same thing. The students pay for internet access in their housing fees and technology fees. It is not something the school provides for free. The mission of the school's network is for academic and research use which includes the free exchange of ideas outside of the classroom and with those outside of the University. So if a University provides a communications medium for which the students pay for as they pay for everything else then it should be as open as possible without being insecure for sensitive systems on the same network (ie the administration computers and databases and such). If you want a network that is only for pure academic use that is what Internet 2 is for.

Re:I can knock it if I want to...

[Chanc_Gorkon]

No in a public university it IS your network. My thing is you should have 2 internet connections through 2 different ISP's. One which BUSINESS happens on and another for the student machines. That way data going in and out of the main administrative and firewalled and vlanned to hell network would not be impacted by student activities and the students can be almost free. You'd still want somethings banned, but most ports should be open (IE, ban NETBIOS and other traffic that some of the worms use).

Re:I can knock it if I want to...

[Facekhan]

As to the bandwidth costing money. Traditional VOIP does not use very much bandwidth and neither does Skype. It uses less than the client of a multiplayer game. What VOIP does require though is fast, consistent delivery of packets. I have a suspicion that one of the issues that College network administrators are concerned about is that VOIP will expose how inefficient and poorly managed many .edu networks are mostly by virtue of the fact that the higher ups in the .edu tech departments are always people who wouldn't know a router from a plunger and they mostly just hand down ridiculous memos full of meaningless buzzwords from the Microsoft and Dell sales pitches. My dept was ordered to manually install 5000 copies of mcaffee personal edition, patch the windows machines on every student computer and then manually trace thousands of unlabeled switch ports in order to make sure no one who had not had mcaffee installed yet had their port turned on. All noted down on scrap paper and hopefully sent to the people who were in command of the switch blades who would hopefully turn on the right ports.

I had to explain to angry parents and students why their 30k a year private university was taking 2-3 weeks after classes started to turn on internet connections. It took about 35 of us (about 28 of them outsourced) 3 weeks just to get the students who really cared about getting online turned on.

Total cost about $600,000. Now why couldn't we have bought a few antivirus appliances to put in the dorms and some routers or firewalls to break up the big broadcasts domains being used to spread the viruses in the first place? Why couldn't we just install a remote administration client on student machines so we could run antivirus and patches automatically?

Re:I can knock it if I want to...

[Psx29]

Are you learning anything by using Skype? No. Is it advancing research? No.

I use Skype all the time to practice and learn foreign languages, and to collaborate with people located in different regions of the world. I would definately say there are many educational applications for Skype, and banning this software from a network is most probably due to a lack of understanding.

Re:I can knock it if I want to...

[Anonymous Coward]

Are you learning anything by using Skype? No. Is it advancing research? No.
I use Skype on conference calls with my team members at school -- we are required to work together on projects and the university recommended Skype as good technology.

Re:I can knock it if I want to...

[aminorex]

And at a private university nobody would dare pull this kind of crap, because they know which side of the bread holds the butter. Public institutions, on the other hand, are just iron rice bowls, endlessly stomping on a human face.

Beware of Skype's third party apps

[Serveert]

They don't have 'em in now but the EULA's allow this going forward.

These are the same guys who wrote Kazaa which installed 3rd party software which basically stole money from mom & pop websites in affiliate networks.

Re:Beware of Skype's third party apps

[Wizarth]

Actually, no. They wrote FastTrack. The company Sharman Networks brought this technology, and made Kazaa with it. THEY are responsible for all the crap that was Kazaa. But not for what made the program useful (the FastTrack network)!

Re:Beware of Skype's third party apps

[aminorex]

No. Read the EULA please.

Skype is not a trojan horse. There's plenty of money to be made on the for-fee POTS dialout, thank you.

How often does skype refresh NAT binding

[moshiko]

Every gateway may have different timeouts for NAT UDP port binding, right?
The PDF doesn't explain how it's done, but it's rather simple, and is explained in the STUN RFC:
1. Open a socket, and tell the server, hi, i'm here, reply to the same address you received this message from, and tell me what that address is (let's call this address REF_ADDRESS_A).
2. Sleep for some time...
3. Open a second socket, and say, hi, i'm here, reply to the same address you received this message from AND to the old address(REF_ADDRESS_A)

If the first opened socket receives the message as well, this means the binding is still valid.
Increase the timeout and try again.
Otherwise, decrease the timeout and try again.

Eventually, it finds the right timeout for the binding.

Having said that, a proper app should really run this routine periodically, because network elements may change.

Salon's satire is better

[Anonymous Coward]

Day-pass is required to read.

http://www.salon.com/opinion/feature/2005/01/20/in augural_satire/index.html

Wrong

[Anonymous Coward]

Thanks to distributed hash tables, it is possible to build scalable flat P2P networks.

Supernodes (aka relays) are required as the last resort to get through bad NATs/firewalls.

The problem with decrypting...

[mightypenguin]

... is that people don't factor in that computers increase in speed by almost a factor of 2 each 18 months or so. So basically, that's like removing 1 bit from your encryption key every 18 months. Factor that in, and you begin to see cracking time numbers orders of magnitude smaller then before.

So basically, public key encryption should still only be used for things that are time sensitive that no one will care about in 5 years. If that's not the case, then you should think about using extremely large keys, like 4000bit, or use quantum encryption.

There is not such thing as absolute security/secrecy.

Re:The problem with decrypting...

[paulatz]

If that's not the case, then you should think about using extremely large keys, like 4000bit, or use quantum encryption. I hope you are joking, or you don't really know how both asymmetric and quantum cryptography work. Quantum cryptography requires really expensive hardware. Asymetric cryptography requires a very long time to encrypt/decrypt and it grows up the size of the message a lot. So it is only used to send a (long) symmetric key.

Re:The problem with decrypting...

[awolk]

There is not such thing as absolute security/secrecy.

If you use an one-time-pad (ie, XOR-ing the bits ofa message with the bits of a random key, which is as long as the message itself) there is, given that you're able to keep the pad itself secret.

However, one-time-pads can only be used if there is a secure way to transfer the pads, so there is absolutely no way to use it with Skype.

Re:The problem with decrypting...

[Hast]

The problem with this is that people don't have perspective on just how enourmously big something 2^256 is. You may think that "it's just a question of time" before you can brute force it.

A good perspective a lecturer of mine offered was that the number of known atoms in the Universe is somewhere in the vicinity of 2^200. Now while that is not really a number you can grasp, it still demonstrates the futility of trying to brute force the encryption.

Even if you factor in Mores law then anything above 56-bit is going to be futile to crack. Even a 128-bit symmetric system will take about 75 years before it's down to something which is remotely brute-forceable.

You are more likely to find a weak spot in the encyption scheme than brute-forcing it.

Re:The problem with decrypting...

[mightypenguin]

I agree that it's still ok for near term stuff. But if you actually want something to NEVER be unencrypted you can't get all cozy with times like 1billion years to crack your messages.

Use of such numbers is a PR stunt that doesn't really reflect reality.

Re:The problem with decrypting...

[Hast]

You don't seem to understand.

Let's say we a list of all of our favourite "almost zero probablilities that would kill you". Stuff like getting hit by a meteor, getting struck by lightning, getting killed by debris from a crashing airplane etc. Lets take the top 1000 of those extraordinarily unlikely events and furthermore let's say that they all happen at the same time.

Now that probability isn't zero, there is a chance that it will happen to you as you go home from work today. It's not particularly likely though. And I'm willing to bet that the chance of that happening is a lot higher than that someone will be able to crack your AES encrypted data with longest keylength.

Perhaps that puts things in perspective for you. This isn't the case that "in a milllion billion years" someone can crack your message. The point is that the Universe will end before they have gone over a significant part of the keyspace.

Re:The problem with decrypting...

[mightypenguin]

Ok, enough conjecture here's some numbers. Assuming that a particular key would take 1billion years to crack by today's computers. That same key would be crackable in ~1 month using computers available 50 years from now. (Assuming 18 months to processor speed doubling, and that my math is right). You can call that irrelevent, or besides the point if you want. But that's a much smaller number to work with then 1 billion. I'm not saying that isn't a formidable number, just that it's not the "uncrackable" 1 billion people bandy about all the time. If we're talking 4 billion that would take only 3 years longer in order to crack it in 1 month. And all of this is assuming that people weren't working on the keyspace during that time period, which would cut the time required dramatically. However, I still agree with you that for most, people they don't have to worry about anyone carying about their encrypted data in 50 or 100 years :) I'm just saying, people get all excited about these huge numbers when their data isn't quite that safe.

Skype vs a SIP solution

[SpooForBrains]

I "discovered" Skype, discovered that it was Linux friendly, and tested it sufficiently to find that it was quite adequate to meet my minimal requirements. So, I asked our technical guru to install it in the office where all the machines also use linux and have a look. I work from home, and since we spend a lot of time on the phone I figured we had the potential to save some money.

He muttered that he'd get around to it sometime, so next time I was in the office I installed it myself, and using the USB VOIP handset he had bought about a year ago for this precise purpose we had a little testing session and found it very useable (we also found out that with our wireless lan my laptop could become the most expensive portable phone ever).

So, next day, at home, I go to call him up and find his skype username offline. I mail him and ask him to log back on, to which he replies that he's not going to, he's experimenting with a SIP based solution, and since that's the protocol Skype must use anyway (no amount of arguement to the contrary got through) he could set up an improved solution.

We experimented for a week with an asterix server and KPhone. It sucked. He bought winmodems to get us external phone access on the system, faffed about for a while, and guess what, many months on, we're still using the phone network and running up the bills.

Now, I'm not arguing that an open source self-managed SIP solution is not the superior option, it almost certainly is. But Skype JUST WORKS.

Oh, yeah, does anyone know the correct pronounciation of Skype? It reads in my head as SKIPE, but a friend of mine insists it's correctly pronounced SKIPPY.

Re:Skype vs a SIP solution

[omahajim]

Oh, yeah, does anyone know the correct pronounciation of Skype? It reads in my head as SKIPE, but a friend of mine insists it's correctly pronounced SKIPPY.

Have you ever called echo123? That should give you your answer.

Reading is Fundamental - WAS:Skype Banned

[tony3w]

Basically, you have to explicitly accept a license agreement with the third party. They say nothing in here about installing and using 3rd party software on your computer without your consent.

Um... did you actually read the excerpt that you posted?

2.4 Third Parties. You acknowledge and agree that the Skype Software may be incorporated into, and may incorporate itself, software and other technology owned and controlled by third parties. Skype emphasizes that it will only incorporate such third party software or technology for the purpose of (a) adding new or additional functionality

I can think of some 'new functionality...' Like sending back 'diagnostic' sessions of voice conversations for review later; like using your machine to distribute software; like creating a distributed network of file sharing control nodes that's nearly impossible to hold anyone accountable for.

I am not saying that they have or will do this. I object to the open-endedness of the agreement. I'm all for free, ubiquitous communication, but I would like to have a vague idea of what will be done to my PC in the process.

or (b) improving the technical performance of the Skype Software. Any such third party software or technology that is incorporated in the Skype Software falls under the scope of this Agreement .

Basically, any software that they want to incorporate into Skype they can add without your additional consent. This provision does not explicitly allow them to add software automatically though. That's in Article 2.5 below...

Any and all other third party software or technology that may be distributed together with the Skype Software will be subject to you explicitly accepting a license agreement with that third party.

If they want to later distribute Skype with Super Duper Toolbar that they don't deem to be party of 2.4(a) or (b) then you will see an agreement for Skype and an agreement for Super Duper Toolbar.

You acknowledge and agree that you will not enter into a contractual relationship with Skype or its Affiliates regarding such third party software or technology and you will look solely to the applicable third party and not to Skype or its Affiliates to enforce any of your rights.

You agree that you won't sue Skype when they bundle Super Duper Toolbar, privacy laws change, and you want to sue someone for tracking your activities online and associating it with your name and address in order to sell you [insert performance enhancing substance here.]

2.5 New Versions of the Skype Software. Skype, in its sole discretion, reserves the right to add additional features or functions, or to provide programming fixes, updates and upgrades, to the Skype Software....

This is where they reserve the right to change what's on your computer at any time. I don't understand why people enter into this type of agreement for a non-essential product with a company that they have no control over.

This concludes your IANAL lesson today. Thanks for joining us.

Skype + Asterisk will be the ideal couple

[Falsebart]

I would like to see an Skype Asterix extension.
http://voip-info.org/tiki-index.php?page=bounty%20 skype
That would be the real killer POTs killer app.
Can any reverse engineering pro give a hand ?

... and on OS X it's in your Library:

[alirano]

~/Library/Skype/shared.xml

Skype or FWD?

[Anonymous Coward]

Skype (http://www.skype.com) or FWD (http://www.freeworlddialup.com/)?

Skype Tunneling

[Doc Ruby]

Is this enough reverse engineering that we can code a Skype/SIP protocol gateway component for an Asterisk server? I'm just referring to all the popular VoIP systems like Vonage as "SIP". The important question is can the Skype protocol network be piggybacked to terminate calls initiated by SIP clients like KPhone or Linphone?

Skype used over sattelite link from mount everest

[Anonymous Coward]

read about it here: VoIPHigh-SKYPEoverSatelliteDec132004

Skype Security

[Anonymous Coward]

In related news, The Soros Foundations recently commissioned a study of Skype's security features with an eye towards using the software in civil society sectors. An interesting read: http://www.soros.org/initiatives/information/artic les_publications/articles/security_20050107/

Re:Skype used over sattelite link from mount evere

[MrAsstastic]

Nice link. This is a quote from the article: "A CIA nightmare Conversation over SKYPE and RBGAN is at present considered impossible to eavesdrop. Thus it is a very cheap way to get a high-level security for military and business purposes, but the same is unfortunately also true for terrorists and criminals. SKYPE uses AES 256-bit encryption which is impossible to crack with present computer technology. The encryption keys are unique for each transfer and not stored by SKYPE. But beware if you are using SKYPE to call a normal landline or a cell phone - that phone can of course be tapped by others. " Hmmmm, I knew I smelled Trouble!

How is BitWise different?

[funtime]

So what is the difference between BitWise (http://www.bitwisechat.com/) and Skype, apart from the fact that BW is a direct-connect chat/voice application and Skype has the potential to node your comp? Does it have the same problems? Is it lame that with BitWise you have to open a port or two?

SIP on Linux

[Richard_J_N]

Speaking of which, has anyone written a howto for SIP on Linux? I spent ages trying to get it working, and in the end, succeeded (the results are here: http://richardneill.org/voip.html ), but my setup has since broken and I don't know why. I also can't get it working properly from behind NAT.

sip? iax?

[SanityInAnarchy]

skype is not the only voip provider. Some of them actually support standards (sip? iax?). Asterix supports those.

Better colours

[Anonymous Coward]

http://shit.slashdot.org/article.pl?sid=05/01/20/1 653217

Skype uses 256-bit AES...

[ikewillis]

Decrypting your phone call? GOOD LUCK!

Skype uses end-to-end cryptography on all calls, up to 2048-bit RSA for the public key exchange and 256-bit AES thereafter.

Skype offers probably the highest strength seamless encryption around.

Re:Skype uses 256-bit AES...

[OldMiner]

Call me criminally minded, but my thoughts went straight towards this sort of approach when I read through the paper. You have the IPs of both parties involved in the call, and you have a known piece of software (Skype) on both ends. Further, you can probably query the versions of their software while you're at it. Given this information, 'all' you need at this point is some buffer overflow in Skype. Provided you can implement an exploit which does not crash Skype, you can then access the machine the data came from and where it's going to. So you could likely access the initial data, or just grab the key for decryption from the destination machine, which would probably be a more bandwidth friendly method.

I'm sure if such a product were put together, plenty of people would find it amusing to just listen to random people's phone calls across the Internet. Once more, the paper indicates that a local list (SC host list) of what servers to initially contact is maintained. While you're listening, if you wish to hear from these two people again, you could then change this list to include you and only you, so they'd always try to connect through your machine until you suggest they use others again.

Luckily, this is all wild speculation, and it's entirely dependent on first gaining knowledge of a flaw in Skype itself.

Shameless plug

[apankrat]

NAT is a real menace

Yes, but true peer to peer is still possible in many
cases with a little help from a routable 3rd party -

Meet the mediated peer-to-peer a.k.a. hamachi

Re:Day Pass

[stevemm81]

You know you can just change the expiration date on the day pass cookie and the day pass will never expire?

It's probably illegal, or something, but it's still funny.

Re:sip? iax?

[aminorex]

Maybe so, but Skype is the only voip provider that has a free softphone that Just Works cross-platform.
And offers an API.

Terminology - SN?

[kenlars99]

SN should really stand for "sucker node" ... 90% of these are going to be machines without a firewall, the owners of which are clueless (like, say, my grandma), that are being suckered into forwarding everyone elses traffic.

Re:Terminology - SN?

[Anonymous Coward]

Does your grandma have a T3?

another skype review on /. check it out

[Anonymous Coward]

anyone remember reading this (why was it modded flamebait?) and this a couple of days ago?

Re:How to Get a Free Mac Mini!

[game kid]

Step 5: ???

Step 6: Realize you'll never Profit from this utter Offtopic crap.