Tonight Skype published a blog post saying that back on April 14th they released a "hotfix" for this problem in Skype for Mac version 5.1.0.922. That's great... it's good that the fix is out there, but...
how were we Mac users supposed to know about it?
Hmmm... let's see... Could we find out about the Skype for Mac hotfix...
- ... using the "Check for Updates" feature? Nope, doesn't work for me. Maybe it works for others out there, but not for me.
- ... from the Skype for Mac Release Notes page? Nope, that page STILL hasn't been updated, three weeks later, to indicate that a new version is out. Nothing on there at all about 5.1.0.922.
- ... from Skype's Twitter account? Nope, no mention of a hotfix back on April 15th, although they did talk about the fact that Skype was mentioned twice on 30 Rock and that there was Skype call on the Rachael Ray show.
- ... from Skype's skypesecurity Twitter account? Nope, no mention.
- ... on Skype's Mac blog? Nope. Last post there was April 14th, the day before this hotfix came out.
No mention of a "hotfix" for Skype 5.1 for Mac OS X on any of those communication vehicles.
In The Garage?
Ah, but wait... Skype did mention the hotfix, over on the Skype Garage blog, which is all about "Experiments and pre-releases". Here's a screen capture of the notice:
So they posted news of this important "hotfix" on a blog for "experiments and pre-releases", didn't tweet it out, and didn't update release notes or put it anywhere regular Mac users would find it.
And a curious thing...
THERE IS NO MENTION OF A SECURITY ISSUE!
Nothing whatsoever.
I am guessing that "Minor bug fixes" must include this security issue. And maybe the fix was simply a "minor bug fix". Maybe someone forgot to do bounds checking on some part of the chat system and as a result a buffer overflow occurred. Maybe it was some simple little fix.
But labeling it in this way gives absolutely no incentive for anyone to upgrade. Even had I seen this notice, I probably wouldn't have bothered to upgrade (unless the Check for Updates had worked). There is no urgency on this.
And... call me crazy, perhaps, but I guess I don't consider a security issue where someone could send me a chat message and gain complete control of my Mac to be a "minor bug"!
Did Skype not think that at some point the security researcher would publish his findings?
And why in the world didn't Skype communicate with this security researcher to tell him that they had fixed the bug he found and would be issuing (in fact had issued a fix)? Now maybe they thought they did... but whatever the situation was, he didn't know and out of frustration published his post today.
It Didn't Have To Be This Way
In other words...
... everything that happened today was COMPLETELY PREVENTABLE had Skype only communicated more.
Skype would not have had the negative coverage in ZDNet, CNet, ComputerWorld, Mashable, TheNextWeb, my own blog ... and many other sites, let alone all the tweeting and retweeting.
Instead of having all this negative activity, they could have jointly come out with a statement with the security researcher or at least crediting the researcher. It would have shown that Skype was serious about security and protecting us - and also serious about working with the security community.
And even after the story broke early today, Skype could have tweeted out a response... or posted the blog post earlier... they could have cut off all the discussions and concerns simply by being more transparent and providing some information - or even just communicating that they were in the process of getting an answer.
Instead, there is only one word to summarize Skype's communications:
FAIL!
The thing that kills me is that Skype employs a ton of truly brilliant engineers. They have on their payroll a couple of the leading SIP/VoIP security researchers that are out there. And these guys know how the security community works.
Knowing some of those folks personally, I have to think that the process broke down somewhere in the external communications side of the house. Because of the IPO and the "silent period", I know that people at Skype are ultra-cautious about saying anything. And maybe that's part of it, but in this case, it truly failed them.
Too bad... because none of all this communication today had to happen.
If you found this post interesting or useful, please consider either:
Google+
