Hacker News Reader

Comment by andwur | Hacker News Reader

I haven't spent much time browsing through the source but the code quality and security is pretty dismal so far. Not to mention the confusing project structure.

Magic numbers, ... and strings, all over the place [0]. Memory leak galore (debug code?) [1]. Probably buffer overflows all over the place, here's one I noticed [2]. I suspect others given the proliferation of opaque pointers and memcpy usage.

[0] https://github.com/skypeopensource/skypeopensource2/blob/mas...

[1] https://github.com/skypeopensource/skypeopensource2/blob/mas...

[2] https://github.com/skypeopensource/skypeopensource2/blob/mas...

View on HN

The magic values look ok to me. I mean, some values are known, some aren't - it's still early days. Hopefully more will be labeled / split up into components with time.

I meant the whole block not just this phrase. "Copyright (c) 2009 by VEST Corporation. All rights reserved. Strictly Confidential!" - that conflicts with openness. Or at least with assigning rights to other people.

To me this project looks like really a just reversed and mostly functional one and this is the quality of said projects, I've been there. He has disassembled, transcribed to a C project almost as-is and made it compile.

The developer may not have enough development experience to organize it decently or just rushed it online because of anxiety.

Anyway, very good resource for others if there still any interest at all at Skype compatibility or else, only missing the .idb with renamed subs and comments. :)

Old patched binaries and .idb are on his onion: http://gzscxpillagce2gf.onion/

"How dare you show your project when it has flaws!"

"How dare you comment on the flaws found in someone's project!"

If issues are never brought to light then it's very unlikely they will ever be fixed. Would you rather everyone just stayed silent?

I have great respect for someone that can put in the time and effort to reverse engineer Skype, and brave Microsoft's legal team in doing so, but in its current state this code can't be used safely and is far from easy to understand either.

I believe that the best way to bring issues to light is pull request. Second best is the issue. Comment on Hacker News is somewhere down the list

If these flaws are minor or inconsequential, then you might be right about your remark but if these flaws are flagrant or critical, then the OP had the right attitude to make concerns public.

A technical review of code isn't a personal attack. Please learn to tell the difference.

You sound like you expect something different from reversed Microsoft code.

I know you are probably joking, but didn't MS buy the code?

Yes, Microsoft bought Skype, it didn't create Skype. There have been many substantive changes since then (e.g. much less peer-to-peer in operation).

Is there any peer-to-peer now, I thought they routed everything through their own servers now?

I don't know. It seems stupid to entirely drop peer-to-peer but maybe that's the case now.

only "stupid" if you are opposed to this:

http://techrights.org/2015/01/02/snowden-leaks-on-spying/

Otherwise, dropping peer to peer is the only way to achieve the projects goals.

You didn't mention the inconsistent (and somewhat weird) formatting of the source code.

https://github.com/skypeopensource/skypeopensource2/blob/mas...

I cannot specify more examples.

I think part of it is caused by the tab-width setting. The developer appears to have been using a tab-width of 4, and there are some instances where they used spaces for indentation without realising.

The only explains some of the wierdness though. That second link is completely inexplicable.

Yes :-)

Reply on news.ycombinator.com