Hacker News Reader

Comment by Xuzz | Hacker News Reader

Please note: this is not an attempt to clean-room reverse engineer Skype, or even to reverse engineer and create an open-source replacement. As shown with things like WINE, Microsoft does not (and probably cannot) take them down.

No, that's not what "Skype Open Source" project is. This is a confusingly misnamed attempt to attach code to patched copies of copyrighted official Skype clients.

Microsoft is not overreaching here; this is what anyone would expect with a lame project like this. I'd love if someone really created an open-source Skype client, but this is not a project to do that.

View on HN

You are wrong. You eyes are blind by hating. Stop. Listen the Nature.

Skype-open-source code here: https://github.com/skypeopensource/epycs

repo was closed because i host in download section deobfuscated skype5.5 binary, my fault.

No, that's bullshit. https://github.com/skypeopensource/epycs/blob/master/sources...

That function right there (and the vast majority of the rest of the file) is a straight decompiled version from Skype. You even use the register names and comment with addresses from the binary.

Having spent a lot of time reversing apps myself, this is a straight copyright violation. Your code is a directly derivative work from Skype.

I wonder if that's a small enough component to count as de minimus copying.

Is there the notion of minimum copyright infringement?

Yes and no. There is no such notion in copyright law. Case law is unclear, however: http://en.wikipedia.org/wiki/De_minimis#Copyright

The jury instructions issued by the judge in the ongoing Oracle vs Google case make considerable reference to the principle: http://www.groklaw.net/pdf3/OraGoogle-1018.pdf

At least 3/4 of those 4000 lines is directly copied from Skype, and that's just one file. I don't think that's small enough to not matter; anyway, if it really was so small, it should easily have been rewritten with original code.

It's the size compared to the size of the relevant copyrighted work that matters, not compared to the size of the work it's copied into.

No that's a simplistic approach. Both matter, for example one volume of the Encyclopedia Britannica is a very small portion of the overall work, but it cannot be freely copied. Likewise if you write a book a million pages long, copying entire chapters does not suddenly become ok.

It is my understanding that "the relevant copyrighted work" in the Encyclopedia Britannica example is likely to be the article rather than the entire encyclopedia.

"No, that's bullshit."

What about you talking? Maybe you need read dictionary definitions of words bull and shit. Pay copyright rent for this words, and stop trolling us.

How exactly is one supposed to make a clean-room reverse engineering in the absence of any documentation and sophisticated obfuscation on Skype's part ?

It's hard, but people have made progress with that approach:

http://recon.cx/en/f/vskype-part1.pdf http://recon.cx/en/f/vskype-part2.pdf

Those links detail reverse engineering the binary. I think Iv's point is that reverse engineering an existing binary is not what "clean room" means.

If team A uses the binary to write a spec, and team B uses the spec to re-implement without direct help from team A, it's generally considered legit.

This was the method used by Compaq to implement the IBM BIOS, back in the day.

Yup, I'm with you. I don't think anyone's done anything like that for Skype, though.

Yes, and we agree that team A's work needs to be done before team B can work. A's work is exactly what this DMCA notification tries to shut down.

> A's work is exactly what this DMCA notification tries to shut down.

What part of A's work involves distributing deobfuscated binaries to the general public?

Team B should only have access to the specifications developed by Team A and nothing else from them. That's the whole point of isolating them.

Usually, that would mean reverse engineering to create specifications and then getting the product implemented by some one else using the specification which would then be termed as clean.

Yes, and reverse engineering to create specifications is done... how ? It requires examination of the only currently working implementation that we have.

The term "clean room" has a well established meaning you probably aren't aware of, I refer you to [1], it might clear up what the original reply was referring to.

[1] http://en.wikipedia.org/wiki/Clean_room_design

I am well aware of the joke that is the clean-room process. Note that it supposes that the first team has access to the specification, source code, or any IP-encumbered indication about how the software in question works. In the case of Skype, the only public information we have is the binary.

>Note that it supposes that the first team has access to the specification, source code, or any IP-encumbered indication about how the software in question works. In the case of Skype, the only public information we have is the binary.

So what? That's not a valid excuse to distribute modified binaries to the public. If the "first" team wants to look at binaries to do their documentation, they can download the official Skype client from skype.com. Why do they need to download a hacked binary from Github?

Well this decisions effectively forbids the "team A" of a clean room process to operate in the regular open source mode of distributed and public development.

I understand the rationale behind it, I think it is wrong and has bad implications for the future.

You are aware that clean room development is about protection from legal problems, not about solving the problem as efficiently as possible, right?

Note that it supposes that the first team has access to the specification, source code, or any IP-encumbered indication about how the software in question works

No it doesn't.

The Wikipeda link[1] mentions the original IBM PC clean room implementation by Columbia Data Products.

It doesn't have the complete story of that, but from memory the way it worked was CDP had one team documenting how the BIOS responded to inputs, and then a totally independent team reimplementing that behaviour.

Most clean room implementation don't have access to a specification, let alone source code.

[1] http://en.wikipedia.org/wiki/Clean_room_design

Interesetingly enough, if you read on about more current cases it mentions Sony vs Connectix, which I thought Connectix lost, but actually the ruling was overturned on appeal.

From the ruling: "Some works are closer to the core of intended copyright protection than others. Sony's BIOS lay at a distance from the core because it contains unprotected aspects that cannot be examined without copying. The court of appeal therefore accorded it a lower degree of protection than more traditional literary works."

Thus one could try to make the same case for Skype.

From my understanding, you are allowed to decompile and inspect the released binaries, as well as intercept and analyze all inbound/outbound data, as long as you aren't modifying the running binary in any fashion. Things like debuggers are commonly used for this goal, as are tools like wireshark for analyzing the traffic. Once you create a specification based on your analysis, someone can create a clean-room implementation from that spec.

Exactly. Deobfuscated version just comfortable to debugging.

Sure, but it doesn't mean you're allowed to publish a deobfuscated version...

This is a serious obstacle to collaborative open-source reverse-engineering.

Yes it is, but thats where other solutions need to be met.... say a script that de-obfuscates a vanilla binary package so the output is created on the users machine vs being distributed as such. You can distribute the script and leave compliance to the end user.

If the result of this script is forbidden to be distributed, this could be a rationale for forbidding the distribution of the script itself.

If I write a script that generates the Matrix movies from the binary file of, say, Elephant's Dream, I won't be allowed to distribute that.

Yes, copyright law is complicated. You need to make sure the script used to create a deobfuscated binary isn't a derived work from the original binary, whatever that means (that's where consulting with a lawyer can help).

Is a patch a derived work from the file it applies to ? It is impossible to produce the patch without using the original file, yet intuitively, I would say no.

Maybe then you're not "supposed" to do it?

For example, there is no reverse engineered libraries for Facetime and iOS API. If you use Apple's libraries, they can come after you for copyright infringement.

You can reverse engineer anything that you can reverse engineer. "Supposed" really doesn't come into it. If you buy a copy of osx and reverse engineer some libraries, then publish a description of their behaviour, so what?

That's fine, but if you publish the modified binaries of OS X's libraries with hacks to make them work in Linux along with the description, you will be in legal hot water.

Cappuccino is exactly such a reverse engineered library, as is gnu step. For that matter Linux is a reverse engineered drop in replacement for the unix kernel.

I'm not familiar enough with Cappuccino to comment, but GNU Step was an independent implementation of the published OpenStep interfaces. That isn't reverse engineering.

Linux is an independent implementation of the Posix interfaces.

Seems like you could do it in theory by observing the protocol in action. Set up two machines a-skyping, sniff all the packets, think real hard, write code that interoperates with Skype clients.

And how do you propose to decrypt those packets?

didn't you see the part about "think real hard"?

Are (were) they distributing the patched binaries or just the tools to do it?

It's hard to tell. The author is clearly not too fluent with English, so it's difficult to tell exactly what he's saying. It sounds like it's based on a decompiled and recompiled version of the core Skype kernel dlls and not a clean room implementation.

There was deobfuscated version of skype 5.5 in downloads section of project. Not in repo.

Code in repo contains reimplementation of skype protocol (RC4 chiper, 41 and 42 encoders) and sample tool capable of sending IM to skype peer.

There also was some tools for extracting user certificate from skype profile.

Right. Now code moved to most fine named - https://github.com/skypeopensource/epycs

Reply on news.ycombinator.com