Skype 1.4.0.99 reads /etc/ passwd and firefox profile!
|
RealBorg
Regular member Posts: 24 ![]() ![]() |
Is there a Skype plugin for Firefox on Linux?
Tom |
| Sun Aug 26 2007, 22:04 · Reply · Quote and reply · Permalink · Top · | |
|
MichaëlK
New member Posts: 3 ![]() |
Ok I think that there is no need to be paranoid, every Linux program that uses functions such as getpwuid() (that's only an example) actually opens /etc/ passwd and parses it in order to get the requested information. I guess Skype calls getpwsomething() and that's why you can see these calls to open() and read() on your passwd file.
compile and strace this program: CODE #include <stdio.h> #include <sys/types.h> #include <pwd.h> int main(int argc, char *argv[]) { struct passwd *toto = getpwuid(getuid()); printf("%s\n" toto->pw_name); return (0); } and modify it in order to comment the call to getpwuid() and do just a simple printf of "hello world" for example, and compile-strace it. You'll see that the first one opens your passwd file, not the second one. That's why ls -l opens it too (because it needs to get some information related to the file owners, because the filesystem only stores the uid of the owner, not the username, so ls uses getpwuid in order to convert it to the proper username) my 2 cents. Quick edit: And for the firefox profile access, I guess that it tries to figure out your proxy settings (if they exist) by reading your profile as it does under MS Windows with MS Internet Explorer, in order to bypass some firewall that would have been there by using an allowed channel (WWW traffic here). But that's only an assumption. This post has been edited by MichaëlK: Mon Aug 27 2007, 00:08 -------------------- Michael K.
|
| Sun Aug 26 2007, 23:47 · Reply · Quote and reply · Permalink · Top · | |
|
h377r1d3r
Advanced Member Posts: 134 ![]() ![]() ![]() |
leo115usa, anotherskypeuser u f***ing grow up, Nobody can ask any questions about Skype? Skype is so beutifull it saved you money and it is so nice and kewl and good "programmed" like anotherskypeuser said and you are so willing to drop your pants and bend over...
I'm sick of idiots like you two. People have right to ask questions, especially that this one was backed up by a log, and it was ONLY A F***ING QUESTION of what is happening there. I havn't seen author saying "oh my, skype is evil i knew it it is reading / etc / passwd and using jtr to decrypt / etc / shadow oh my..." no, it was only a f*cking simple question. And then you two come along defenders of the crown, two knights on shiny horses protecting the castle of Skype: "argh... thou shall not bad mouth skype argh... thou shall be exploited and turned into zombie argh..." Live and let live anotherskypeuser leo115usa and similar. If you have nothing constructive to add then shut the f*ck up ! |
| Mon Aug 27 2007, 05:02 · Reply · Quote and reply · Permalink · Top · | |
|
John Do
Regular member Posts: 26 ![]() ![]() |
QUOTE(h377r1d3r @ Mon Aug 27 2007, 06:02) [snapback]434180[/snapback] leo115usa, anotherskypeuser u f***ing grow up, Nobody can ask any questions about Skype? Skype is so beutifull it saved you money and it is so nice and kewl and good "programmed" like anotherskypeuser said and you are so willing to drop your pants and bend over... I'm sick of idiots like you two. People have right to ask questions, especially that this one was backed up by a log, and it was ONLY A F***ING QUESTION of what is happening there. I havn't seen author saying "oh my, skype is evil i knew it it is reading / etc / passwd and using jtr to decrypt / etc / shadow oh my..." no, it was only a f*cking simple question. And then you two come along defenders of the crown, two knights on shiny horses protecting the castle of Skype: "argh... thou shall not bad mouth skype argh... thou shall be exploited and turned into zombie argh..." Live and let live anotherskypeuser leo115usa and similar. If you have nothing constructive to add then shut the f*ck up ! Calm down. I guess you got the post of anotherskypeuser as wrong as he misinterpreted the quote made by ajsoft. Or where did leo115usa bring up any facts, anotherskypeuser could refer to in its post? And leo115usa is no more than a troll and not worth raising your blood pressure BTW tossing around swear words isn't grown up either Anyway, out of curiosity I also did an strace, but used the newer skype version 1.4.0.99 and couldn't find a single occurence of / etc / passwd or firefox in it. Maybe I am to stupid to find it, so anybody feel free to run the following command and search the resulting log: CODE $ strace -v -i -s 9999 $( which skype ) >| skype-strace.log 2>&1 So maybe in the new version there is no more need to read those files? J.D. |
| Mon Aug 27 2007, 07:20 · Reply · Quote and reply · Permalink · Top · | |
|
ellinger
New member Posts: 1 ![]() |
QUOTE Anyway, out of curiosity I also did an strace, but used the newer skype version 1.4.0.99 and couldn't find a single occurence of / etc / passwd or firefox in it. CODE $ strace -v -i -s 9999 $( which skype ) >| skype-strace.log 2>&1 Neither can I (skype 1.4.0.99, feisty .deb) This post has been edited by ellinger: Mon Aug 27 2007, 07:36 |
| Mon Aug 27 2007, 07:35 · Reply · Quote and reply · Permalink · Top · | |
|
Victor Jerlin
New member Posts: 1 ![]() |
QUOTE(John Do @ Mon Aug 27 2007, 07:20) [snapback]434205[/snapback] Calm down. I guess you got the post of anotherskypeuser as wrong as he misinterpreted the quote made by ajsoft. Or where did leo115usa bring up any facts, anotherskypeuser could refer to in its post? And leo115usa is no more than a troll and not worth raising your blood pressure ;) BTW tossing around swear words isn't grown up either ;) Anyway, out of curiosity I also did an strace, but used the newer skype version 1.4.0.99 and couldn't find a single occurence of / etc / passwd or firefox in it. Maybe I am to stupid to find it, so anybody feel free to run the following command and search the resulting log: CODE $ strace -v -i -s 9999 $( which skype ) >| skype-strace.log 2>&1 So maybe in the new version there is no more need to read those files? J.D. I would add the switch -f for strace to follow forks and try again. The only entries it tries to open as files which could be questionable are ~/.mozilla/firefox/blablabla.default/prefs.js and ~/.opera/opera6.ini.. both of which actually contain the proxy-configuration. On a lighter note though, the post from h377r1d3r really cracks me up.. I was reading about a 10 year old teen who bypassed an internet-filter, I wonder why he reminds me of that story. |
| Mon Aug 27 2007, 10:09 · Reply · Quote and reply · Permalink · Top · | |
|
MichaëlK
New member Posts: 3 ![]() |
Note that if you're using some kind of caching service (maybe nscd or nsswitch (not a caching system for this one, but that changes how names etc get resolved)) you won't find any occurence of /etc/ passwd.
This post has been edited by MichaëlK: Mon Aug 27 2007, 10:21 -------------------- Michael K.
|
| Mon Aug 27 2007, 10:19 · Reply · Quote and reply · Permalink · Top · | |
|
writebenjamin
New member Posts: 1 ![]() |
QUOTE(leo115usa @ Sat Aug 25 2007, 12:39) [snapback]433533[/snapback] Why don't you guys grow up? there is no big brother. You sound like hippies stuck in the seventies. If you think education is expensive try ignorance... There may not be a big brother today (doubtful), but if you give up your freedom of choice and privacy, you can bet there will be one tomorrow... Get educated, this isn't about being conspiracy theory fanboys, it's about basic human rights for privacy and freedom. http://www.youtube.com/watch?v=TbNIU2KEz4g |
| Mon Aug 27 2007, 11:23 · Reply · Quote and reply · Permalink · Top · | |
|
xurizaemon
Regular member Posts: 14 ![]() ![]() |
QUOTE(Martin80 @ Sun Aug 26 2007, 17:12) [snapback]433943[/snapback] And why can't the forum software deal with /etc/ passwd written together? Ironically, Skype have programmed their forum software to prevent attempts to read the webserver's passwd file. Mind if I take a look at yours, though? Hehe ... |
| Mon Aug 27 2007, 11:27 · Reply · Quote and reply · Permalink · Top · | |
|
John Do
Regular member Posts: 26 ![]() ![]() |
QUOTE(Victor Jerlin @ Mon Aug 27 2007, 11:09) [snapback]434249[/snapback] I would add the switch -f for strace to follow forks and try again. [...] Thanks for the hint. Now I can confirm that skype reads the firefox profile too: CODE $ strace -v -f -i -s 9999 $( whence skype ) 2>&1 | egrep '\<open\(.*/\.mozilla' [pid 5606] [b7f02410] open("/home/fool/.mozilla", O_RDONLY|O_NONBLOCK|O_LARGEFILE|O_DIRECTORY <unfinished ...> [pid 5606] [b7f02410] open("/home/fool/.mozilla/firefox", O_RDONLY|O_NONBLOCK|O_LARGEFILE|O_DIRECTORY) = 14 [pid 5606] [b7f02410] open("/home/fool/.mozilla/firefox/default", O_RDONLY|O_NONBLOCK|O_LARGEFILE|O_DIRECTORY) = 15 [pid 5606] [b7f02410] open("/home/fool/.mozilla/firefox/default/adblockplus", O_RDONLY|O_NONBLOCK|O_LARGEFILE|O_DIRECTORY) = 16 [pid 5606] [b7f02410] open("/home/fool/.mozilla/firefox/default/forecastfox", O_RDONLY|O_NONBLOCK|O_LARGEFILE|O_DIRECTORY) = 16 [pid 5606] [b7f02410] open("/home/fool/.mozilla/firefox/default/forecastfox/icons", O_RDONLY|O_NONBLOCK|O_LARGEFILE|O_DIRECTORY) = 17 [pid 5606] [b7f02410] open("/home/fool/.mozilla/firefox/default/forecastfox/errors", O_RDONLY|O_NONBLOCK|O_LARGEFILE|O_DIRECTORY) = 17 [pid 5606] [b7f02410] open("/home/fool/.mozilla/firefox/default/extensions", O_RDONLY|O_NONBLOCK|O_LARGEFILE|O_DIRECTORY) = 16 [pid 5606] [b7f02410] open("/home/fool/.mozilla/firefox/default/extensions/{0538E3E3-7E9B-4d49-8831-A227C80A7AD3}", O_RDONLY|O_NONBLOCK|O_LARGEFILE|O_DIRECTORY) = 17 [pid 5606] [b7f02410] open("/home/fool/.mozilla/firefox/default/extensions/{0538E3E3-7E9B-4d49-8831-A227C80A7AD3}/chrome", O_RDONLY|O_NONBLOCK|O_LARGEFILE|O_DIRECTORY) = 18 [pid 5606] [b7f02410] open("/home/fool/.mozilla/firefox/default/extensions/{0538E3E3-7E9B-4d49-8831-A227C80A7AD3}/defaults", O_RDONLY|O_NONBLOCK|O_LARGEFILE|O_DIRECTORY) = 18 [pid 5606] [b7f02410] open("/home/fool/.mozilla/firefox/default/extensions/{0538E3E3-7E9B-4d49-8831-A227C80A7AD3}/defaults/icons", O_RDONLY|O_NONBLOCK|O_LARGEFILE|O_DIRECTORY) = 19 [pid 5606] [b7f02410] open("/home/fool/.mozilla/firefox/default/extensions/{0538E3E3-7E9B-4d49-8831-A227C80A7AD3}/defaults/preferences", O_RDONLY|O_NONBLOCK|O_LARGEFILE|O_DIRECTORY) = 19 [pid 5606] [b7f02410] open("/home/fool/.mozilla/firefox/default/extensions/{0538E3E3-7E9B-4d49-8831-A227C80A7AD3}/defaults/transforms", O_RDONLY|O_NONBLOCK|O_LARGEFILE|O_DIRECTORY) = 19 [pid 5606] [b7f02410] open("/home/fool/.mozilla/firefox/default/extensions/{0538E3E3-7E9B-4d49-8831-A227C80A7AD3}/components", O_RDONLY|O_NONBLOCK|O_LARGEFILE|O_DIRECTORY) = 18 [pid 5606] [b7f02410] open("/home/fool/.mozilla/firefox/default/extensions/{4776510a-a1f4-41f3-a3c8-35b474ecef23}", O_RDONLY|O_NONBLOCK|O_LARGEFILE|O_DIRECTORY) = 17 [pid 5606] [b7f02410] open("/home/fool/.mozilla/firefox/default/extensions/{4776510a-a1f4-41f3-a3c8-35b474ecef23}/chrome", O_RDONLY|O_NONBLOCK|O_LARGEFILE|O_DIRECTORY) = 18 [pid 5606] [b7f02410] open("/home/fool/.mozilla/firefox/default/extensions/{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}", O_RDONLY|O_NONBLOCK|O_LARGEFILE|O_DIRECTORY) = 17 [pid 5606] [b7f02410] open("/home/fool/.mozilla/firefox/default/extensions/{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}/chrome", O_RDONLY|O_NONBLOCK|O_LARGEFILE|O_DIRECTORY) = 18 [pid 5606] [b7f02410] open("/home/fool/.mozilla/firefox/default/extensions/{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}/defaults", O_RDONLY|O_NONBLOCK|O_LARGEFILE|O_DIRECTORY) = 18 [pid 5606] [b7f02410] open("/home/fool/.mozilla/firefox/default/extensions/{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}/defaults/preferences", O_RDONLY|O_NONBLOCK|O_LARGEFILE|O_DIRECTORY) = 19 [pid 5606] [b7f02410] open("/home/fool/.mozilla/firefox/default/extensions/{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}/components", O_RDONLY|O_NONBLOCK|O_LARGEFILE|O_DIRECTORY) = 18 [pid 5606] [b7f02410] open("/home/fool/.mozilla/firefox/default/extensions/{73a6fe31-595d-460b-a920-fcc0f8843232}", O_RDONLY|O_NONBLOCK|O_LARGEFILE|O_DIRECTORY) = 17 [pid 5606] [b7f02410] open("/home/fool/.mozilla/firefox/default/extensions/{73a6fe31-595d-460b-a920-fcc0f8843232}/chrome", O_RDONLY|O_NONBLOCK|O_LARGEFILE|O_DIRECTORY) = 18 [pid 5606] [b7f02410] open("/home/fool/.mozilla/firefox/default/extensions/{73a6fe31-595d-460b-a920-fcc0f8843232}/defaults", O_RDONLY|O_NONBLOCK|O_LARGEFILE|O_DIRECTORY) = 18 [pid 5606] [b7f02410] open("/home/fool/.mozilla/firefox/default/extensions/{73a6fe31-595d-460b-a920-fcc0f8843232}/defaults/preferences", O_RDONLY|O_NONBLOCK|O_LARGEFILE|O_DIRECTORY) = 19 [pid 5606] [b7f02410] open("/home/fool/.mozilla/firefox/default/extensions/{73a6fe31-595d-460b-a920-fcc0f8843232}/components", O_RDONLY|O_NONBLOCK|O_LARGEFILE|O_DIRECTORY) = 18 [pid 5606] [b7f02410] open("/home/fool/.mozilla/firefox/default/extensions/{9D23D0AA-D8F5-11DA-B3FC-0928ABF316DD}", O_RDONLY|O_NONBLOCK|O_LARGEFILE|O_DIRECTORY) = 17 [pid 5606] [b7f02410] open("/home/fool/.mozilla/firefox/default/extensions/{9D23D0AA-D8F5-11DA-B3FC-0928ABF316DD}/chrome", O_RDONLY|O_NONBLOCK|O_LARGEFILE|O_DIRECTORY) = 18 [pid 5606] [b7f02410] open("/home/fool/.mozilla/firefox/default/extensions/{9D23D0AA-D8F5-11DA-B3FC-0928ABF316DD}/defaults", O_RDONLY|O_NONBLOCK|O_LARGEFILE|O_DIRECTORY) = 18 [pid 5606] [b7f02410] open("/home/fool/.mozilla/firefox/default/extensions/{9D23D0AA-D8F5-11DA-B3FC-0928ABF316DD}/defaults/preferences", O_RDONLY|O_NONBLOCK|O_LARGEFILE|O_DIRECTORY) = 19 [pid 5606] [b7f02410] open("/home/fool/.mozilla/firefox/default/bookmarkbackups", O_RDONLY|O_NONBLOCK|O_LARGEFILE|O_DIRECTORY <unfinished ...> [pid 5606] [b7f02410] open("/home/fool/.mozilla/firefox/default/searchplugins", O_RDONLY|O_NONBLOCK|O_LARGEFILE|O_DIRECTORY) = 16 [pid 5606] [b7f02410] open("/home/fool/.mozilla/firefox/default/prefs.js", O_RDONLY) = 13 I have set up my skype to not log me in at startup. The above output appears exactly in the moment I hit <Return> after typing in my password. So it seems the assumption about the proxy settings is right. But I would consider this bad practice, although I am not a coder. To me it looks like someone in school who didn't do his homework and always copied the answers of the class mate sitting next to him. But hey, we already know that skype tries really hard and successful to pierce firewalls. QUOTE(MichaëlK @ Mon Aug 27 2007, 11:19) [snapback]434255[/snapback] Note that if you're using some kind of caching service (maybe nscd or nsswitch (not a caching system for this one, but that changes how names etc get resolved)) you won't find any occurence of /etc/ passwd. Thanks for that one too. greping the output of strace revealed: CODE [pid 7285] [b7f7d410] open("/etc/nsswitch.conf", O_RDONLY <unfinished ...> J.D. This post has been edited by John Do: Mon Aug 27 2007, 13:16 |
| Mon Aug 27 2007, 13:04 · Reply · Quote and reply · Permalink · Top · | |
|
vordan
New member Posts: 1 ![]() |
This is just a guess, but ...
- Skype needs to learn which is the active Firefox profile in order to install the Firefox add-in which makes phone numbers "live" on a web page, so you can click on it and make the call via Skype. - I am not sure why it needs to read the passwd file, but what could it find there? Usernames? So what? It can't "unhash" the passwords, and, anyway, why would it need to? Their software Skype should - very soon - come clean with some statement explaining this thing and clearing the FUD it created. In the meantime, Skype is off my computers. |
| Mon Aug 27 2007, 13:24 · Reply · Quote and reply · Permalink · Top · | |
|
chilinux
New member Posts: 3 ![]() |
QUOTE(vordan @ Mon Aug 27 2007, 13:24) [snapback]434310[/snapback] - I am not sure why it needs to read the passwd file, but what could it find there? Usernames? So what? It can't "unhash" the passwords, and, anyway, why would it need to? Their software (skype) is already installed on your computer and has access to it. Skype should - very soon - come clean with some statement explaining this thing and clearing the FUD it created. In the meantime, Skype is off my computers. It doesn't need to read passwd file. I doubt the Skype Linux client developers even know why the file is being read. The truth comes out when looking at a backtrace at the point the client issues the open() syscall to read the passwd file. The bottom line is that Skype is built using Troll Tech's Qt widget set which in turn is built on top of the X11 libraries. This adds enough complexity that the application author ends up with several things being done on his/her behalf indirectly and several times without the author intentionally doing it. In this case, Qt's QMetaObject calls X11's Inter Client Exchange Library which calls X11's Session Management Library which calls the Libc's getpwuid_r(). Correcting this will probably require a modification to the X11 libraries. As long as we are paranoid about a X11 application reading the passwd, maybe we should use AppArmor to block access to the .Xauthority and .ICEauthority. After all, if skype is compromised, being able to read these files will provide access to the MIT magic cookies which can assist in attacking the X11 server. Then again, if you do use AppArmor to block skype from reading the MIT magic cookies then to run skype would require doing a "xhost +" which anyone security savvy enough to run AppArmor would never do. So, I guess the answer is to run xnest so that skype can have it's own dedicated X11 server with it's own separate X11 magic cookies! I would also recommend unplugging your computer from the Internet but that could also hinder using skype. :p My advice to ZaphodB is if skype runs with AppArmor blocking passwd read access then go ahead and block it. In terms of the complaints that AppArmor logs, keep drinking Pan Galactic Gargle Blasters until you no longer notice the complaints. Actual backtrace information from gdb running skype: Breakpoint 2, 0x00d8cbf0 in open () from /lib/libc.so.6 (gdb) info frame Stack level 0, frame at 0xbfc32e58: eip = 0xd8cbf0 in open; saved eip 0xd2e2c2 called by frame at 0xbfc32e84 Arglist at 0xbfc32e50, args: Locals at 0xbfc32e50, Previous frame's sp is 0xbfc32e58 Saved registers: eip at 0xbfc32e54 (gdb) x/s *0xbfc32e58 0x5877353: "/etc/ passwd" (gdb) bt #0 0x00d8cbf0 in open () from /lib/libc.so.6 #1 0x00d2e2c2 in __GI__IO_file_open () from /lib/libc.so.6 #2 0x00d2e465 in _IO_new_file_fopen () from /lib/libc.so.6 #3 0x00d230ed in __fopen_internal () from /lib/libc.so.6 #4 0x00d2314c in fopen@@GLIBC_2.1 () from /lib/libc.so.6 #5 0x058740aa in internal_setent () from /lib/libnss_files.so.2 #6 0x05874497 in _nss_files_getpwuid_r () from /lib/libnss_files.so.2 #7 0x00d5b413 in getpwuid_r@@GLIBC_2.1.2 () from /lib/libc.so.6 #8 0x002d4576 in ?? () from /usr/lib/libQtGui.so.4 #9 0x002d4d3c in ?? () from /usr/lib/libQtGui.so.4 #10 0x008e651f in _SmcProcessMessage () from /usr/lib/libSM.so.6 #11 0x00ca4fbc in IceProcessMessages () from /usr/lib/libICE.so.6 #12 0x002cdd18 in ?? () from /usr/lib/libQtGui.so.4 #13 0x002cdd97 in ?? () from /usr/lib/libQtGui.so.4 #14 0x00af762a in QMetaObject::activate () from /usr/lib/libQtCore.so.4 #15 0x00af7f12 in QMetaObject::activate () from /usr/lib/libQtCore.so.4 #16 0x00b131e3 in QSocketNotifier::activated () from /usr/lib/libQtCore.so.4 #17 0x00afccdf in QSocketNotifier::event () from /usr/lib/libQtCore.so.4 #18 0x0028589d in QApplicationPrivate::notify_helper () from /usr/lib/libQtGui.so.4 #19 0x0028b7e9 in QApplication::notify () from /usr/lib/libQtGui.so.4 #20 0x00ae5c6b in QCoreApplication::notifyInternal () from /usr/lib/libQtCore.so.4 #21 0x00b070df in ?? () from /usr/lib/libQtCore.so.4 #22 0x00fa97f2 in g_main_context_dispatch () from /lib/libglib-2.0.so.0 #23 0x00fac7cf in ?? () from /lib/libglib-2.0.so.0 #24 0x00facd35 in g_main_context_iteration () from /lib/libglib-2.0.so.0 #25 0x00b07168 in QEventDispatcherGlib::processEvents () from /usr/lib/libQtCore.so.4 #26 0x002feb85 in ?? () from /usr/lib/libQtGui.so.4 #27 0x00ae5191 in QEventLoop::processEvents () from /usr/lib/libQtCore.so.4 #28 0x00ae529c in QEventLoop::exec () from /usr/lib/libQtCore.so.4 #29 0x00ae763a in QCoreApplication::exec () from /usr/lib/libQtCore.so.4 #30 0x00284ea7 in QApplication::exec () from /usr/lib/libQtGui.so.4 #31 0x0806a2fd in QFrame::paintEvent () #32 0x00ce1f70 in __libc_start_main () from /lib/libc.so.6 #33 0x08069691 in QFrame::paintEvent () (gdb) This post has been edited by chilinux: Tue Aug 28 2007, 02:32 |
| Tue Aug 28 2007, 00:40 · Reply · Quote and reply · Permalink · Top · | |
|
Morphy
New member Posts: 1 ![]() |
all of these doubts make me think about:
how can we trust closed source? |
| Tue Aug 28 2007, 09:48 · Reply · Quote and reply · Permalink · Top · | |
|
cereal
New member Posts: 1 ![]() |
QUOTE(John Do @ Mon Aug 27 2007, 07:20) [snapback]434205[/snapback] Anyway, out of curiosity I also did an strace, but used the newer skype version 1.4.0.99 and couldn't find a single occurence of / etc / passwd or firefox in it. Maybe I am to stupid to find it, so anybody feel free to run the following command and search the resulting log: CODE $ strace -v -i -s 9999 $( which skype ) >| skype-strace.log 2>&1 So maybe in the new version there is no more need to read those files? J.D. I did a strace on Skype 1.3.0.53_API on Ubuntu 5.10, no firefox calls, but only a read on passwd: CODE [b7fd648d] close(8) = 0 [b7fd6cb1] munmap(0xb6f2c000, 65036) = 0 [ffffe410] open("/etc/ passwd", O_RDONLY) = 8 [ffffe410] fcntl64(8, F_GETFD) = 0 [ffffe410] fcntl64(8, F_SETFD, FD_CLOEXEC) = 0 |
| Tue Aug 28 2007, 09:50 · Reply · Quote and reply · Permalink · Top · | |
|
Ryan Hunt
Advanced Member Posts: 224 ![]() |
It has come to our attention that some users are unhappy about the files Skype for Linux reads during its normal operation.
The files in question are accessed using a standard method, common to Linux, to discover the username of the person running Skype in order to figure out where to save the Skype internal data files. We don't read any locally stored system passwords. We are not nosy. There is no good reason why we would ever wish to snoop into our user's computers. At no time is information stored on your computer sent to Skype or anyone else without your consent. For those that are technically savvy, you can see in CODE src/corelib/io/qfsfileengine_unix.cpp of Trolltech's QT's source code the function CODE getpwuid() which is used to convert a user's ID into a name that can be displayed to the user. |
| Tue Aug 28 2007, 19:22 · Reply · Quote and reply · Permalink · Top · | |
|
amdfanatyk
Regular member Posts: 9 ![]() ![]() |
QUOTE(Ryan Hunt @ Tue Aug 28 2007, 19:22) [snapback]434854[/snapback] The files in question are accessed using a standard method, common to Linux, to discover the username of the person running Skype in order to figure out where to save the Skype internal data files. We don't read any locally stored system passwords. In fact there is no need "to figure out where to save" settings - QSettings takes care of it. QUOTE We are not nosy. There is no good reason why we would ever wish to snoop into our user's computers. At no time is information stored on your computer sent to Skype or anyone else without your consent. Easy to say but these words have no value until source code will become available. Skype is the only close source application for Linux I know - maybe I don't know so many (I don't think so) - You shouldn't be surprised that it looks at least strange. If Skype for Linux is divided in at least two parts: engine and interface, why source code of interface cannot be opened? Engine doesn't read "private data" so it can remain closed (precompiled + headers). -------------------- |
| Tue Aug 28 2007, 21:04 · Reply · Quote and reply · Permalink · Top · | |
|
John Do
Regular member Posts: 26 ![]() ![]() |
QUOTE(amdfanatyk @ Tue Aug 28 2007, 22:04) [snapback]434883[/snapback] In fact there is no need "to figure out where to save" settings - QSettings takes care of it. [...] And that would not result in / etc / passwd being accessed? I am not a Coder so reading the source does not make much sense for me. But I guess, that QSettings would also use getpwuid() or a similar function. Or how does QSettings get that data? J.D. |
| Tue Aug 28 2007, 21:30 · Reply · Quote and reply · Permalink · Top · | |
|
amdfanatyk
Regular member Posts: 9 ![]() ![]() |
QUOTE(John Do @ Tue Aug 28 2007, 21:30) [snapback]434892[/snapback] And that would not result in / etc / passwd being accessed? I am not a Coder so reading the source does not make much sense for me. But I guess, that QSettings would also use getpwuid() or a similar function. Or how does QSettings get that data? J.D. That's minor issue. When I was reading explanation I thought they mix C with C++ and Qt in order to obtain home directory. qapplication_x11.cpp CODE // tell the session manager about our program in best POSIX style sm_setProperty( SmProgram, QString( qApp->argv()[0] ) ); // tell the session manager about our user as well. struct passwd* entry = getpwuid( geteuid() ); if ( entry ) sm_setProperty( SmUserID, QString::fromLatin1( entry->pw_name ) ); This post has been edited by amdfanatyk: Tue Aug 28 2007, 21:59 -------------------- |
| Tue Aug 28 2007, 21:58 · Reply · Quote and reply · Permalink · Top · | |
|
flob
Regular member Posts: 14 ![]() ![]() |
what do you wanna say with "that's minor issue"? (when in the next sentence admitting that you "thought" something that's obviously wrong.)
BTW: "In fact there is no need "to figure out where to save" settings - QSettings takes care of it." is probably one of the strangest things to say when it comes to not reading /etc/ passwd. |
| Tue Aug 28 2007, 22:16 · Reply · Quote and reply · Permalink · Top · | |
|
bunnyfly
New member Posts: 3 ![]() |
QUOTE(amdfanatyk @ Tue Aug 28 2007, 21:04) [snapback]434883[/snapback] If Skype for Linux is divided in at least two parts: engine and interface, why source code of interface cannot be opened? Engine doesn't read "private data" so it can remain closed (precompiled + headers). That is so smart! I totally second that. There is, in this case, little reason (except corporate vanity) to not release the interface code. Actually it would benefit Skype. An opensource team would improve the interface much quicker than Skype's willing to, and Skype's team could focus on the engine - getting video and other high demand functionality would happen much faster. Skype's corporate image would also look better! It would be the perfect publicity stunt. Skype getting their customers to do their work for them makes the open sourcers think Skype's working "with the customers," It would be ideal - they still get the money from the service and can focus on improving that, working in a few layoffs or resource reallocation, while the Linux community creates the program THEY want, in turn boosting Skype's usage on Linux computers in general. [bunnyfly] This post has been edited by bunnyfly: Wed Aug 29 2007, 03:06 |
| Wed Aug 29 2007, 03:03 · Reply · Quote and reply · Permalink · Top · | |
1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)
0 Members:





See how our products are performing on the