Skype sets rules for third-party plugins

 

Gallery

By Simon Aughton

Posted on 6 Feb 2008 at 12:01

Skype has released a hotfix for the Windows version of its internet telephony and IM software. While most of the changes are bug fixes, the 3.6 update incorporates the recently introduced controls on which third-party applications can plug into the Skype API.

Introduced in 2004, the API allows third parties to develop products that hook into the Skype service. The aim is to block malware while enabling genuine add-ons to function smoothly.

The new controls add a pair of central access control lists, a blacklist and a whitelist, to the existing local access control list (ACL). These enable Skype to automatically block malicious applications, while Skype Certified software and drivers for Skype Certified hardware can work without the API access dialog ever popping up. Users retain the ability to control the local ACL, blacklisting and whitelisting applications as they require.

API controls aside, the update improves connection speed to the Skype network from restrictive network environments, and provides a score of bug fixes.

These include a fix for a cross-zone scripting vulnerability that could enable arbitrary code to be executed via video hosted on a remote site.

Other squashed bugs include an issue where a USB webcam plugged in while a call is in progress wouldn't start video, plus problems with MySpace IM and voicemail. A number of bugs that could cause Skype to crash have also been addressed.

Skype 3.6 is available from skype.com/download or via the built-in update feature.