Stuart Henshall

Buddylist NDA - Do you have one?

March 29, 2006 11:10 AM

Topics:

Buddylist NDA. I've always thought that what I shared via my buddylist "presence" "mood messages" was between me and my buddies. Now that is not always the case. There's an "unofficial" Skype Plug-in that's getting a little testing on the side. A couple of my favorite Skypers are involved. Kevin Delaney and Jaanus Kase. Moodgeist is their project and sets a dangerous precedent. To my knowledge this is the first time the idea of a "buddylist NDA" has been breached in the use of a plug-in.

moodgeist.pngThe description for Moodgeist is below. An example of how my "mood" was exported is in the picture. Note it is anonymous. My mood at the top of the list. However, they probably have my name on the export as they are capturing mood information across different users. The problem is not these two guys and their neat little program. It's a great experiment and I'm sure there is nothing nefarious in the code. The problem is. I can't trust others and what they put on their PC's. They may even mistakenly put something on their PC.

Then we have bots harvesting names, capturing and exporting data and exchanges. The only way to stop on accessing your info drop is to drop all your buddies. Now clearly that doesn't work.

The problem remains. There is no trust level control in adding buddies. I wrote on this before when Skype first launched their API, and again when Skype launched SkypeWeb pointing out that it was all or nothing. That same behavior and set of beliefs appears to flow into the API. It's wrong. we need a minimum of two levels. level one is presence and mood sharing etc however "no exporting" of our information via the API. Unfortunately that will impact negatively on some API applications.

We need a better solution. I'm inclined to believe that presence (unless enabled for skypeweb), mood messages and avators, location in the future, all represents data that a "colleague" may not access via the API but can see in the Skype client. By contrast a buddy may access them all via the API. Take this a step further and buddies should be able to see and exchange information on which plug-ins they are each using, as approved, banned, and currently active. From a developer point of view that would help the "viral" spread of new API applications.

The fact remains that you can't limit text. Plus if someone wanted to export it / copy it then they will anyways. In that sense it is no different to making an audio recording. The distinction is the application that goes beyond manipulating your data and exchanges with others to actively exporting it for other benefits. An example would be a well written Market Research API application.

Skype appear blind to this. Youthful and perhaps naively they say.. hey you can do this on MSN etc in no time flat. What's the big deal? The big deal is security. The problem is also users aren't smart enough to get this until burned. Thus Skype's responsibility is to take a lead on it. This is a hard problem that needs solving.

What is Moodgeist?

Moodgeist is an experiment to show what’s currently happening in the “Skype Land” and what’s the Skype community’s collective state of mind.
How can I use Moodgeist?

You can use Moodgeist in two ways.

* if you just want to browse the data, then you can do so right on moodgeist.com front page, or use the API if you need some other feeds.
* it would be great if you also pinged Moodgeist with data for your own contacts. This helps us all to get a more complete “big picture”. For this, please install the Pinger program and just leave it running — there’s nothing more you need to do. You will then see data from your own contacts showing up in the “collective state of mind”.

How does Moodgeist work?

Moodgeist consists of two parts.

* “pinger” is the program that sits in the computers of the users who have chosen to install it, and “pings” over the data from their Skype contact lists to the Moodgeist server. Read more about the pinger and Ping protocol.
* “server” is moodgeist.com — it collects and stores the pinged data and publishes it for everyone to see and use.

Are there any privacy or security concerns around Moodgeist?

The “mood messages” concept is quite new and part of Moodgeist’s objective is to test out how people feel about this kind of thing. See this discussion for more.
Moodgeist Description

The SkypeAPI provides the opportunity for all sorts of things. The question remains. Do you trust your buddies and are you happy about having everything you do exported.even when your buddy may not be aware. That's what happens in Moodgeist. I want to share my mood more broadly. Cool I add the plug-in. However, I'm sharing the moods now for many of my pals too. This could easily be worked into something neat. Example: Think about "collective polling" of moods and mood changes. You could easily program it to do a reminder: your mood hasn't changed in 3 days... is everything ok? It would create new chats or potential for chats.

Currently you cannot access the "avatar" info via the API like you can "moods". Thus avatars are not exportable. Updates to the Avatar and the Moods cannot currently be synched either. If they were I'd expect many to put up their own personal ad servers. A simple API app would serve them up to all multi-chats and to the buddylist whenever you weren't in a call. At other times.. it could provide other details. There are other opportunities that aren't yet available. For example Could I share mood messages differently with different groups of buddies? Currently no. If I could I might use the mood message to share who I'm in a call with. Note you could share the mood "In a Call" with all your buddies now if the plug in was done correctly. This example also highlights the dilemma in Moodgeist. If one of my buddies installs a plug in to share "in a call" info with his work buddies... My action of using Moodgeist may share who he is in a call with the whole world. That's a security breach in. There are benefits to both.. but be careful what gets compromised.

Skype should look more seriously at concepts that may help users to federate and accelerate the exchange of certain information. Trading information is smart when it is for my benefit. I won't mind rewarding the agent. Are we going to go in that direction? That remains unclear to me.




Trackback Pings

TrackBack URL for this entry:
http://www.skypejournal.com/cgi-bin/mt/mt-tb.cgi/2138

Comments

Posted by: John S. Richards at March 29, 2006 1:50 PM

Stuart, Thanks this is a good article on Moodgeist, a program best to avoid.

Posted by: Neil Lindsey at March 29, 2006 5:31 PM

I understand your concern that Skype profile information should be no more gatherable by a program that uses the API than by any UNauthorized interactive Skype user, but the security concern should be extended to ANY third-party program that potentially can do many things to your PC without your approval. It all boils down to "who do you trust?"

Or to put it another way, it is the same user that is running that API-based program that can clearly see all the same information you speak of in the buddylist, so really there is no security breach from that perspective. However, if the user running that program was not told about what that information might be being used for, then that's where 'trust' comes in.

The same argument could be used regarding Skype itself -- who knows what else is going on under the sheets that we haven't been told about?


Posted by: Teller at March 30, 2006 12:22 AM

Stuart, he's name is Jaanus.

Post a comment




Remember Me?

(you may use HTML tags for style)





Other Recent Posts

Skype 3.0 Folder Pollution in Life | Products | Skype杂志 | complaints | design | ebay | skype | skypejournal | voip | wishlist on 11/22/06

Skype 3.0 Beta for Windows; bugfix build 137 in General Notices | News | Products | Skype News | Skype杂志 | ebay | skype | skypejournal | voip on 11/22/06

Skype PR Wake Up Call III: The Commentary in Business | Every Post | Ideas & Views | Marketing | Skype News | Skype杂志 | Strategy | ebay | observations | skype | skypejournal | voip on 11/22/06

Wednesday morning scan in Business | Life | Marketing | News | Products | Skype Partner Watch | Skype杂志 | Strategy | Technology | Tips & Tricks | Yahoo | counterpoints | design | ebay | freedom | observations | regulation | skype | skypejournal | voip on 11/22/06

Yes, TalkPlus reverse engineered Skype. in Developers | North America | Skype Partner Watch | Skype杂志 | Strategy | Technology | ebay | skype | skypejournal | voip on 11/21/06

Email to a friend