Slashdot Mirror


Skype For Microsoft Edge Will Work From the Browser, No Plug-Ins Required

We mentioned a few months back Microsoft's beta of a browser-based intrerface to Skype. Now, reports Engadget, Skype will be able to work without a plug-in (as was required for the beta). However, it will work -- at least at first -- only with Microsoft's Edge browser. The latest Windows 10 Insider Preview build comes with Object RTC API. That's the element that allows real-time audio and video communication without the need for any installation not just for Skype for Web and Outlook.com, but also for other WebRTC-compatible services. To note, Chrome, Firefox and Safari all support WebRTC standards, but it's unclear if and when Skype will enable a plug-in-less experience for those browsers, as well.

49 of 89 comments (clear)

  1. Separate code from data by Anonymous Coward · · Score: 5, Insightful

    Please don't run executable code inside my document viewer.

    kthxbye

    1. Re:Separate code from data by ChunderDownunder · · Score: 2

      Plugin Framework??? That is sooooooooo last millennium. We've killed off Flash, Java and the Acrobat Plugin because they were security nightmares.

    2. Re:Separate code from data by Dutch+Gun · · Score: 2, Insightful

      The entire reason we want these things as plugins is so that I don't have to have them installed if I don't use them. Turning executable code a plugin does NOT make it insecure. The only thing a plug-in does is to make that code *optional* for each user. You want a minimal default attack surface, and adding built-in extras broadens that surface unnecessarily.

      The reason Flash, Java, and Acrobat Reader plugins are insecure is because they were written long before internet security was a thing. Even today we're seeing new zero-day exploits in Flash that give arbitrary data user-level access. Why does anyone believe that the Skype codebase won't be subject to the same sort of attacks and vulnerabilities once it becomes part of the browser?

      --
      Irony: Agile development has too much intertia to be abandoned now.
    3. Re:Separate code from data by phantomfive · · Score: 2

      Please don't run executable code inside my document viewer.

      Welcome to......Javascript? It's a little late for that, really.

      --
      "First they came for the slanderers and i said nothing."
    4. Re:Separate code from data by westlake · · Score: 2

      >Please don't run executable code inside my document viewer.

      The mainstream web browser ceased to be a simple document viewer a long time back. The browser is an ananomoly

    5. Re: Separate code from data by phantomfive · · Score: 1

      Why?

      This is why.
      Do you think that sort of vulnerability can't be exploited from Javascript? Oh yes it can.

      --
      "First they came for the slanderers and i said nothing."
    6. Re:Separate code from data by ChunderDownunder · · Score: 3, Insightful

      Why does anyone believe that the Skype codebase won't be subject to the same sort of attacks and vulnerabilities once it becomes part of the browser?

      Because with plugins you're relying on a separate sandbox model from the rest of the browser.

      I'd sleep more soundly at night knowing that the executable code used to make video calls through webRTC was running through exactly the same sandbox as other executable code such as asm.js. or that the inbuilt pdf viewer in Firefox (dog slow that it may be) was running with the same javascript security execution model rather than relying on an external engine (and yes Mozilla do have a flash implementation that works in a similar way to PDF.js)

      There will be security holes in any implementation but there's one attack surface for the entire web platform rather than one for each browser plugin. And at the end of the day I'd rather trust Mozilla or Google to release timelier fixes for their web-browsers than rely on Microsoft's skype plugin to be updated.

      So broadly I'm in favour of cross platform technologies such as video chat 'bloating' the HTML5 spec rather than relying on proprietary browser plugins.

    7. Re:Separate code from data by fisted · · Score: 1

      an ananomoly

      A what?

    8. Re:Separate code from data by Trogre · · Score: 1

      HTML is executable code.

      --
      "Nine times out of ten, starting a fire is not the best way to solve the problem." - my wife
    9. Re:Separate code from data by Anonymous Coward · · Score: 2

      This.

      Apparently Microsoft looked at the way Mozilla is handling Firefox and thought now was the time to throw their hat into the ring by including more crap into the broswer. Even though, as already pointed out, they should know better by now because of things like ActiveX.

      There really needs to be a solid basic web browser with no cruft. Perhaps allow a plugin system for features users want on a per user basis, but nothing built in. That browser should then be promoted everywhere by everyone as a good alternative. (In case I need to say it: Anyone that knows of such a browser feel free to post a link.)

      As for the reason why the Flash, Java, and Acrobat Reader plugins are unsafe, it's not because of when they were written. It's because of what they are designed to do. Both Java and Flash (via ActiveScript) are virtual machines that execute arbitrary programs. Of course if you randomly execute something from the internet without checking it first you are asking for trouble. That's why Java and Flash never should have been permitted on the web to begin with. They auto-execute anything that the browser downloads that says it's a program for it. (Or at least that was the case originally.)

      Adobe Acrobat is a document editing application. An application has no purpose consuming random data from the internet without it being checked first. Otherwise yes, it can contain a payload for a bug in the program and use it to exploit the system. Automating the opening of what should be a desktop application with data from the internet was (and still is) a very stupid idea. That warning was brushed aside by managers that wanted faster document opening and didn't care about nor have the technical knowledge to know about the consequences of such decisions.

      Long story short, if you accept random data (or worse programs) from the internet and start using it without doing any form of basic safety / security checking on it, then yes you can (and probably will) get hacked by it. Web browsers are for viewing documents from untrusted sources. It's an abuse of web browsers to be using them for other purposes, and yes it's extremely dangerous to use a web browser in place of what should be a desktop application. Putting more crap into web browsers that should be desktop applications (like skype) is NOT what we should be doing if we want to protect the internet and it's users.

    10. Re:Separate code from data by Tough+Love · · Score: 1

      HTML by itself is not Turing complete. You need CSS for that.

      --
      When all you have is a hammer, every problem starts to look like a thumb.
    11. Re:Separate code from data by TheDarkMaster · · Score: 1

      You are out of luck. The new kids (the new generation of developers) thinks convenience is more important than security or stability.

      --
      Religion: The greatest weapon of mass destruction of all time
    12. Re:Separate code from data by bledri · · Score: 1

      You are out of luck. The new kids (the new generation of developers) thinks convenience is more important than security or stability.

      Same as it always was.

      --
      Some privacy policy Slashdot.
  2. But does it run Linux? by Anonymous Coward · · Score: 1

    But does it run Linux?

    1. Re:But does it run Linux? by smittyoneeach · · Score: 1

      If you change the name of your file from "NataliePortmanNakedAndCoveredInHotGrits.mp4" to "Linux.mp4" then, yes, you can say it runs Linux.
      Hope that helps.

      --
      Get thee glass eyes, and, like a scurvy politician, seem to see things thou dost not.--King Lear
    2. Re:But does it run Linux? by Tough+Love · · Score: 1, Informative

      The Skype servers all run Linux. I guess Microsoft finally got burned enough times trying to make IIS do what Linux does, to stay well enough away from that. But they did reconfigure the server topology to make it easier to spy on corporate traffic for example, or anything else they feel like.

      --
      When all you have is a hammer, every problem starts to look like a thumb.
  3. Interesting for UI fans by seanellis · · Score: 1

    Since the release of Skype 7.0 (actually the preview version, 6.22), the largest thread on the the Skype community forum has been about one request - can we have our screen space back?

    (My take on this at great length at http://moteprime.org/article.p...)

    This news gives me some hope that, with appropriate HTML and RPC chops, we will see third-parties allow users some measure of customization of the Skype UI.

  4. mmm surveillance. by Last+Warrior · · Score: 3, Insightful

    I suspect well be getting the always on, talk to your web browser functionality so you dont have to click anything when you want ot make a call. You can just say "skype, call my mom" and and bing, skype will inform microsoft, the nsa, and your mom that you want to talk. And when you dont want ot talk to mom, skype will make sure any naughty keywords you use while sitting at your computer are also promptly forwarded to the NSA as well.

    1. Re:mmm surveillance. by Kjella · · Score: 4, Funny

      And when you dont want ot talk to mom, skype will make sure any naughty keywords you use while sitting at your computer are also promptly forwarded to the NSA as well.

      As long as the NSA isn't forwarding the naughty keywords to my mom....

      --
      Live today, because you never know what tomorrow brings
    2. Re:mmm surveillance. by geoskd · · Score: 1

      skype will make sure any naughty keywords you use while sitting at your computer are also promptly forwarded to the NSA as well.

      And your mom...

      --
      I wish I had a good sig, but all the good ones are copyrighted
    3. Re:mmm surveillance. by Big+Hairy+Ian · · Score: 1

      I thought the main purpose of Skype since MS bought it was to stay up and running all the time so that if you did start a TOR circuit it can pop it's head out the other end and wave a flag

      --

      Build a Man a Fire, and He'll Be Warm for a Day. Set a Man on Fire, and He'll Be Warm for the Rest of His Life.

  5. Re:Fan of Skype App in Windows 10 Insider by locksmithsinscottsda · · Score: 1

    U must be joking brother Microsoft really going to provide soft app for free.

  6. Not gonna help Edge get market share by ITRambo · · Score: 4, Informative

    With Windows 10 at ~9% market share of desktop OS's, Edge is currently at ~2%. Incorporating Skype isn't going to help Edge attract many more users, if any, since it still is not compatible with many websites and crashes more than other browsers. I use Edge solely to open my Outlook.com mail since the Mail app in Windows 10 won't do the job. The whole Windows 10 situation is quite fubar, it seems to me.

    1. Re:Not gonna help Edge get market share by Tough+Love · · Score: 1

      With Windows 10 at ~9% market share of desktop OS's, Edge is currently at ~2%.

      For the moment, running behind Linux desktop. Of course, completely clobbered by Linux Android.

      --
      When all you have is a hammer, every problem starts to look like a thumb.
    2. Re:Not gonna help Edge get market share by iampiti · · Score: 1

      In another desperate move to get people to use Edge using it was one of two official methods of watching the latest presentation of new Apple iPhones. The other one, of course, was using Apple hardware. I wonder how much Microsoft paid Apple for the privilege.
      Another thing: Microsoft, why don't you make Windows 10 so that people like it? Then maybe they'd use it willingly and you wouldn't have to resort to desperate moves such as installing malware that constantly pesters you to "upgrade" on previous versions of Windows.
      Make all the mobile, integrated services and spying completely optional and I'm in. It's simple, but it looks they don't want me. I can't even pay for a version of Windows 10 that doesn't suck.

  7. Re:Too late by Anonymous Coward · · Score: 3, Insightful

    Unfortunately, Microsoft has completely ruined Skype, and they will probably never be able to recover the users they lost. My grandparents got locked out when Microsoft started requiring a Microsoft ID, so I switched them to gchat. Plugins are easy enough to install and unless Microsoft fixes the ridiculous Microsoft ID requirement, I can't see many people using Skype ever again. Let's face it, Microsoft is just not competive with the new generation of tech companies and the only reason they lasted as long as they did is because they had a near monopoly, maintained by compatibility issues, for decades.

    I've multiple Skype accounts since ages. Never been forced to require a Microsoft ID. Stop spouting bullshit.

  8. Re:Microsoft is embracing and extending WebRTC by TheCycoONE · · Score: 1

    Except that ORTC is an open standard, that is being pushed by both Microsoft and Google because it's better / easier to use than WebRTC. WebRTC could be extinguished but no harm is done except to early adopters (and even they could just plug in a shim.)

  9. Two purposes by phantomfive · · Score: 1

    The problem here is that the browser has become two different things:

    1) A document browser.
    2) An app-runner.

    As much as I hate it, there is huge demand for an app-runner, so that use case is not going away. The mistake was to try to tie both of these things into the same web-browser framework. We could have had a document viewer separated from an app-runner, but instead we have them both mixed together, with all the complexity that entails. It's not a problem that's going away, and expect Javascript exploits to multiply in the next few years, if not decades.

    There's too much momentum with Javascript + HTML to go back now.

    --
    "First they came for the slanderers and i said nothing."
    1. Re:Two purposes by Tough+Love · · Score: 1

      As much as I hate it, there is huge demand for an app-runner...

      You mean a crapp-runner. Browser native apps are nearly always strangely worse than native with fewer features, more bugs, more security holes and slower response. Being able to incorporate into your browser-based workflow is a plus, but usually that is botched too so that essential browsing functionality you would expect just doesn't work. For example, you should be able to open any link in a new tab but that just doesn't work in a lot of the fancy stuff.

      Not that Microsoft is the only offender, far from it. (Gmail, we're looking at you.)

      --
      When all you have is a hammer, every problem starts to look like a thumb.
  10. Seriously, who cares? by mauriceh · · Score: 1

    Whether a plugin is needed , or not?

    --
    Maurice W. Hilarius Voice: (778) 347-9907
    1. Re:Seriously, who cares? by gstoddart · · Score: 2

      Short version: Microsoft is going to bake in the security holes so low that it will be exploitable in epic ways.

      Just like every time Microsoft decides to embed this stuff at a level nobody else can ... and there will be much pwning.

      --
      Lost at C:>. Found at C.
  11. No plugin? by countach · · Score: 1

    I don't think I consider building the code into the MS browser as being cause to celebrate that no plugin is needed.

  12. Re:Why not just utilize Web Audio + ASM.js by buckfeta2014 · · Score: 1

    Why use a proprietary technology?.

    This is microsoft we're talking about, proprietary is what they do best.

    --
    Buck Feta. You know what to do.
  13. Re:I just don't care by ChunderDownunder · · Score: 1

    I lost my self respect long ago.

    'stupid people' want to interact with me and Skype was there to facilitate that.

  14. Re:Microsoft is embracing and extending WebRTC by roca · · Score: 1

    "Pushed by Google"? Last I heard, Google was for WebRTC over ORTC.

  15. Black tape over the camera works fine.... by Anonymous Coward · · Score: 1

    At least black tape over the camera works.

    Bad news though, tape over the mic holes on a modern tablet DOES NOT WORK, I've tried recording with several layers of tape over every hole and the audio is still pretty damn good. Enough sound gets in to tablets/laptops/etc via the case and any socket holes to let built in mic work.

    Scotch/Cellotape doesn't work over the camera either, it sees through it and focusses beyond the fuzziness of the tape. Has to be black tape.

    There's a lot to be said for fridges. If you put your electronics in there they are air tight, so limit sound, and light.

  16. Not Safari by POWRSURG · · Score: 1

    I know it's easy to simply cut and paste from the original article (heck, it's one way to get people to actually read part of the article), but why not make corrections to gross errors?

    Apple is not supporting WebRTC and has not implemented any of the features necessary for it. Not in desktop nor in mobile.

  17. Re:Microsoft is embracing and extending WebRTC by Anonymous Coward · · Score: 1

    They're for both. WebRTC and ORTC are to merge. There's also a talk by Trent Johnsen from Hookflash about the confusion around ORTC.

  18. Such innovation by Trogre · · Score: 1

    It looks like Microsoft Corporation just invented Firefox Hello, or Facebook Video chat.

    --
    "Nine times out of ten, starting a fire is not the best way to solve the problem." - my wife
  19. Re: Too late by mann17 · · Score: 1

    Yes you can sign in without it, the point is, it is difficult enough to make people switch : http://www.tomshardware.co.uk/...

  20. I don't care, it's garbage by slashmydots · · Score: 1

    It still can't render basic flash in under about 15 seconds and ummm oh let me think....oh yeah! THE ADDRESS BAR IS HIDDEN! Who designed that slow, clunky, unusable pile of garbage?

  21. Pidgin plugin by BigBrownChunx · · Score: 1

    Damn, now I have more work to do on the Pidgin plugin. Anyone know if gstreamer supports ortc yet? ;)

  22. Re:eeeee by dave420 · · Score: 2

    Extinquish? I knew you weren't playing with a full deck of cards, but still...

  23. Re:Microsoft is embracing and extending WebRTC by Lennie · · Score: 2

    You are partly correct.

    WebRTC has 2 parts: protocols & codecs (RTCWeb WorkingGroup at the IETF) and the browser API (WebRTC at the W3C). Al lot of the people are the same people.

    All parts of WebRTC was already being worked on before Microsoft really got involved. And Microsoft wanted a more low level browser API than the other WebRTC browser API that was already being worked on. Microsoft wanted this for things like Skype.

    Eventually a new community group (not workgroup) was formed at the W3C to work on a new API called ORTC.

    The working group at W3C that works on WebRTC have committed themselves to adopt ORTC. So now WebRTC has 2 APIs, only Microsoft has an implementation of ORTC. Firefox, Chrome/Chromium and Opera have an other. And it looks like WebKit/Safari will get WebRTC support too.

    The older API is easier to use, because the newer API is more low level, but there are or will be Javascript libraries which will present you with one API which should work with both.

    Having a low level isn't such a strange thing any more in browser/webdevelopment land, because as it turns out you can have Javascript libraries which abstract the stuff most don't need to know. Because a lot of times webdevelopers use those anyway, to abstract the differences between browsers.

    It's starting to look like more and more browser APIs will be more low level, so high level APIs can be built on top and changed more easily.

    Lots of people/companies who work together at the W3C have now basically made this policy:
    https://extensiblewebmanifesto...

    --
    New things are always on the horizon
  24. Re:Microsoft is embracing and extending WebRTC by Lennie · · Score: 1

    Correction, I checked:

    The W3C Working group has NOT yet committed themselves to adopting the ORTC API from the community group.

    So basically, Microsoft is still on their own. The browser API is not a standard yet and it might still change before it is part of the real WebRTC standard.

    --
    New things are always on the horizon
  25. An entirely new case of... by vikingpower · · Score: 1

    ...bloatware.

    --
    Religous speak to God. Insane are spoken to by God. When all shut up, one can finally hear Shostakovich in peace
  26. Re:Only on Microsoft Browser by vikingpower · · Score: 1

    That's what I have been thinking for some time now. Microsoft still has deep pockets, but one day these are going to get empty, what with all the spending on Nokia takeovers, failed OS versions etc. etc. I can't wait for the day, really, and will dance on their grave.

    --
    Religous speak to God. Insane are spoken to by God. When all shut up, one can finally hear Shostakovich in peace
  27. Re:Fan of Skype App in Windows 10 Insider by locksmithsinscottsda · · Score: 1

    Really don't understand that the Skype app how works ? I know that how do i use it as well.

  28. Re:SubjectsInCommentsAreStupid by lesincompetent · · Score: 1

    Oh look M$\fed shills downvoting negative comments! Color me surprised!