French Court Allows Reverse Engineering of Skype Protocol | Hacker News Reader

French Court Allows Reverse Engineering of Skype Protocol

translate.googleusercontent.com

243 pointsp4bl086 comments

A friend of mine, @ouanilo (french), actually reversed the Skype protocol: http://www.oklabs.net/skype-reverse-engineering-the-long-jou...

Wondering why it didn't really get out there tho.

The rest of the website has more information about the journey, and an actual fake Skype client.

The court follows the EC Directive for legal protection of computer programs, specifically Article 6. Every EU country should have laws in place that allow for reverse engineering within certain limits.

See page 4 [PDF]: http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2...

Sometimes, we can be proud to be french ;-)

For interoperability purpose, "reverse engineering is a legal practice, and that the distribution of software using a protocol found in this way is not illegal"

I have no problems with your country. Any country that ties traffic infractions to income is fine with me. I heard most of your schooling is free to? The French have a lot we(USA) should look into.

There's no such thing in France, maybe you're mistaken with some Nordic countries?

Edit : I was talking about the traffic fines.

Source : I'm French, which may explain my broken English.

School is free until high school in France, and university can be considered as free as well, because it is extremely cheap compared to the USA/Canada/UK for example, and because there is plenty of help to students with low resources.

> School is free until high school in France

Friendly fyi: "until" is generally exclusive in English. An similar word that is inclusive is "through". So "I'm on vacation until Monday" implies they will be in the office on Monday, but "I'm on vacation through Monday" implies they will be back Tuesday. I understood what you meant, but for a moment I thought you were saying that you had to pay for highschool in France.

France, Sweden, Finland, Germany, Ireland, Poland, (etc ...) what's the difference when you're not from the EU ? =)

> maybe you're mistaken with some Nordic countries?

I think it's switzerland [0]

[0] http://www.rts.ch/info/suisse/1118676-bientot-des-amendes-se...

French school isn't free, you're just basically paying it afterwards, threw many taxes including personnal income based taxes.

I'm french and paying taxes so that all children - including those from underprivileged environments - have, at least in theory, access to a free education is one thing I'm quite proud of.

Who said you should have not to be proud? Proudness apart, your school is still not "free, as in beer".

You didn't say that, as actually I'm not proud of anything related to nationality (it was a reference to the first post in the thread). What I meant is that in the particular case of the education system, the contribution system you mentioned allows socially deprived people to actually access the education system for free, as in beer.

So actually we're complementing each other: access to school is free for every one, but school isn't free for the citizen. My point was to say that "free school" should not be mentioned, instead we should speak of "school paid by taxed citizens for everyone" which is more accurate.

Well, you've already understood: I'm french too ;)

Agreed :)

Yeap, they're basically free and it shows. Most universities have buildings that make you feel like living in a post-apocalyptic world.

Makes me wonder how much reverse engineering the DGSE has done...

It's a bit more complicated, you can reverse-engineer if the company is not willing to give the protocol, for interoperability purpose only and you are not allowed to publish the raw information you obtained during the reverse, but only a new interoperable product.

Journalistic treatment has probably distorted the facts so someone should probably go read the actual decision.

What do you mean by "raw information"? Can you publish a detailed protocol specification?

Here is a rough translation, I'm sorry to tell that I have a hard time parsing the original in the context of OSS too.

IV. The reproduction of the code of the software or the translation of the shape of the code is not subject to the author's authorization when the reproduction or translation in the sense of 1° and 2° of article L. 122-6 is essential to get the information necessary to the interoperability of an independently created software with other softwares provided the following conditions are met:

1) those actions are fulfilled by the person with the right to use one copy of the software or on his behalf by someone empowered to this end;

2) the informations needed for interoperability have not been easily and quickly available to the people mentioned at 1° above;

3) and those actions are limited to the part of the original software needed to this interoperabilty

The information obtained this way [disassembly] shall not be:

1) Neither used for any other purpose than interoperability of the independently created software

2) Neither communicated to thirds parties unless that is necessary for the interoperability of the independently created software

3) Neither used for development, production or sale of a software whose expression is substantially similar or for any other act infringing the author's copyright

Further along the lines of what panzi is asking, could you publish OSS that contains code that would make obvious how to interact with the protocol?

http://www.legifrance.gouv.fr/affichCodeArticle.do;jsessioni...

Hard to say, probably no from what I read here, but I don't know what the past decisions were.

Huh, what law would you break by publishing the reverse engineered details? They're not protected by copyright or patents. Do you mean it's possible for a court to uphold some license or contract terms where you promised not to do it?

I guess that would be Code de la propriété intellectuelle - Article L122-6-1

Here's the law http://www.legifrance.gouv.fr/affichCodeArticle.do?cidTexte=... (Google Translate at your own risk)

It's indeed pretty restrictive, some parts:

> Les informations nécessaires à l'interopérabilité n'ont pas déjà été rendues facilement et rapidement accessibles aux personnes mentionnées au 1° ci-dessus

> Informations required for interoperability, haven't been easily and quickly accessible.

This one is pretty easy to argue, unless you reverse engineer an application that implement a standardized protocol / format.

> ces actes sont limités aux parties du logiciel d'origine nécessaires à cette interopérabilité.

> You can only reverse engineer the parts needed for interoperability

Make sense.

> Les informations ainsi obtenues ne peuvent être communiquées à des tiers sauf si cela est nécessaire à l'interopérabilité du logiciel créé de façon indépendante ;

> Obtained informations cannot be shared with others unless it's required for interoperability.

Should be easy to workaround by making an open source library.

Could that be used to outlaw open source implementations? It's not strictly necessary after all...

There are many reasons to be proud to be French, but since the French law is just an implementation of an EU directive this is hardly one of them.

Frankly, I never understood why anyone should be proud because they happen to be of a certain nationality.

It's like being proud of coincidence. Weird, but hey, why not?

Because it skews your priorities and introduces more cognitive biases?

I'm proud I rolled a 6 on my dice.

But... that's one less than average! (Assuming 2d6)

Who wants to be average?

Though it may look otherwise, the opinions of citizens have a fair weight in government policy.

Because nationality is a choice? I have two, and am working on a third one.

Probably a defensive reaction to all the negative comments made about a nationality... and to prevent the children(and even adults) of said nationality from internalizing the negativity. In short, to provide balance.

Why is it so strange to be proud of the blessings of good fortune?

If you are born beautiful, can't you be proud of it?

If you are part of an ancient and rich civilization, can't you be proud of it?

I guess if you are ancient and rich you could be proud of it . If your papers say you were born in an ancient and rich group but you're none, what should you be proud of ?

It really boils down to you as an individual vs the country you are enlisted in.

You can respect it and count your blessings but what are you proud for if you didn't contribute anything to it?

Now if you are part of an ancient and rich civilization and you continue to further that civilization, that you can be proud of.

If one does enough regression in analysis, even your contributions and works can be traced to genes and environment you didn't exactly choose.

Why wouldn't personal beauty, health or intelligence be considered part of that civilization - and if I procreate, I am furthering it :)

Well procreating is an achievement in itself, so it is something you can be proud of.

Will you be proud of your children sometimes? Because they could have been born in any family in the world...

The question is whether your children should be proud of the accomplishments of their parents. Presumably, you have some responsibility for the accomplishments of your children.

Then couldn't a voter be proud of the accomplishments of the people that have been elected?

It's not pride of being born at a certain location (that's coincidence), It's pride to be part of a community (state, city, organization, ...) that makes good, rational decisions. Like how you can be proud if you live in a country with a sensible healthcare system or patent system, or proud to work at a company with good policies and a healty work environment.

Why should you be proud of being part of a community that makes good, rational decisions? That's also coincidence.

(You should be happy and thankful, perhaps. But not proud, because, to any reasonable approximation, you have had nothing to do with it.)

One of the advantages of living in a democracy means that you do get a say in who gets elected to make the laws. The main disadvantages are that other people do too, and that the pool of politicians you draw from is mostly unappetizing.

By that logic, we can't hold people responsible for electing idiots.

Because hopefully you're part of this community by choice. I chose to move to Silicon Valley and be part of the community there precisely because I was dissatisfied with the communities I lived in prior to that; in effect, I vote with my time and taxes.

I agree that being proud of where you're born is silly; but being proud of where you chose to live is slightly different.

Hmm. But then, as an American, does that mean I shouldn't let the bad things my government does bother me except inasmuch as it affects myself?

The assumption of course being that it only applies to communities where you have some say in the matter, such as through democracy.

If you have not heard of Kurt Vonnegut's term 'granfalloon', you may be interested in http://en.wikipedia.org/wiki/Granfalloon .

A granfalloon is a false karass. http://en.wikipedia.org/wiki/Bokononism .

You can be proud of anything or anyone who you can identify with or somehow are connected with, without any accomplishment on your part.

You can be proud of your kids because they belong to you. You can be proud of your family because you belong to it. You can be proud of your favorite sports team because you root for them.

BUT if you can be proud of it for its accomplishments, you also should be ashamed of it because of its errors.

Nationalists are people who love to claim the accomplishments of their country, but deny its errors.

EDIT: This is not to say that one has to mention all errors everytime one expresses pride.

I think the EU directive has been much influenced by the CNIL and the preexisting french laws. The CNIL (http://en.wikipedia.org/wiki/CNIL) was very influencial 20 years ago. It has lost most of its power now, but its main results remain.

My understanding is that CNIL works/worked on data privacy issues, which does not appear to be related to the issue of reverse engineering. You might be thinking about the Directive on Privacy and Electronic Communications (2002/58) http://en.wikipedia.org/wiki/Directive_on_Privacy_and_Electr....

France was a key founder of the EU.

And?

It might be a good reason to be proud if you were a key founding member of the EU, but it's not nearly as impressive if it's just your favorite collective.

This French law existed before. The EU directive probably comes from the preexisting French law.

As far as I can tell the "French law" would be Article L122-6-1 of Code de la propriété intellectuelle which is dated 10 May 1994. The Eu Software Directive was first enacted in 1991. The text of the French law is almost verbatim the text of the directive.

It's even more explicit than the dates, the article was created by this law: "Loi n° 94-361 du 10 mai 1994 portant mise en oeuvre de la directive (C. E. E.) n° 91-250 du Conseil des communautés européennes en date du 14 mai 1991 concernant la protection juridique des programmes d'ordinateur et modifiant le code de la propriété intellectuelle"

edit: link http://www.legifrance.gouv.fr/affichTexteArticle.do;jsession...

Ok I did not know that, thanks !

I wonder what would have happened in the United States. I think the DMCA probably couldn't be construed to apply to this, but I guess accessing Skype's servers could be considered exceeding authorized access, similar to the 3Taps case (http://www.mediapost.com/publications/article/207055/#axzz2i...)...

Reverse engineering of protocols should be as American as the First Amendment!

I'm pretty sure it's legal in the US as well. The gold method is two teams: One reverse engineers and writes documentation, and the second team implements based on the documentation and never sees the original.

The question is if it's legal to talk to the skype servers this way.....

This is known as http://en.wikipedia.org/wiki/Clean_room_design

I really hope Pidgin/Audium leverages the source code, or someone else does it and makes a Pidgin plugin. The native Skype client on Linux crashes quite a bit.

Protocols are like languages, in the sense that they aren't the data or protection of data, but provides a structural framework for communicating. Languages are also in itself not information, and not secure, it's only when you apply security that happens.

This can be compared to letting people try reverse engineer some indigenous language in my eyes.

Hmm... it seems European law seems to fair a lot better then American law when it comes to attempted abuse by big companies.

I don't know if it's just because the judges are more sane but well done. I think I respect the french slightly more now :)

The EU company sold skype to an american company. Now they don't care to protect it.

Reverse engineering is quite legal in the U.S. too.

It might also be because of less lobbying efforts targeting the EU.

The EU has had a few incidents where targeted lobbying efforts from the entertainment-industry almost has gone through unnoticed and uncontested.

I'm afraid that this, while a significant decision, will lot mean much in practice. Companies can play cat and mouse indefinitely, and have more resources than hobbyists, if they need their protocols to remain secret.

A French company should now be able to offer a chat messenger which is interoperable with Skype for sale, potentially giving it to keep up with the cat and mouse game.

It will be easy for free software to offer such a solution, the problem is that commercial software probably can't promise much about how much or how long it will be interoperable. I'd be reluctant to pay for a commercial skype client that can break tomorrow.

The free version could also break at any time of course. What you'd be paying for the privilege of having a client that works again the day after tomorrow.

Also, the ability to run chat bots on the Skype network is something that can be quite valuable for certain companies.

Well aren't there a lot of licensed physical devices with a Skype client (I'm thinking actual phones)? A breaking change would require an update to the firmware on those devices, which seems non-trivial.

In the case of Skype, your right: Skype can probably change their protocols and ruin the work of the reverse enginners. But this would have a price: Skype users would have to install the last version of the client to be able to communicate with their contacts. If Microsoft started to modify the Skype protocol each week, the users would probably get tired of updating their client weekly and they would use another software.

For others proprietary softwares, breaking the compatibility with old versions is hardly conceivable: If Photoshop or AutoCAD where suddenly unable to use read and write the terabytes of data created by their users, those users would probably throw their PC through the window and never buy again a proprietary software...

Didn't Microsoft basically reverse engineer Google's Youtube API's to make that WP8 Youtube app? I wonder if Google will consider integrating a reverse engineered Skype into Hangouts. Not that I'm particularly excited myself about joining a fully spied upon chat service, but it would be an interesting move.

Wasn't this the case with ICQ? That is, once the protocol was reverse engineered, all the protocol authors had to do was change it slightly and the 3rd party implementations had to play catch up.

Can someone explain why this is a significant decision ?

Eet iz formidable!

This makes me laugh, mostly because it will alienate the French govt from the US Govt, but also because its basically anti-IP.

You forgot the main reason : because it goes against your preconceived ideas about "The French".

I'm not sure I follow, the only preconceived ideas I have about the French relate to food and music. If the French want to tick off the USGovt, I have no quarrel.

> but also because its basically anti-IP.

And, most remarkably, according to the EU legislation which tends to hinder lobbyists, at least once in a blue moon.

Reply on news.ycombinator.com