🚀 go-pugleaf

[Crossposted/followups-to concordia.dept.iits.help]

[Since Mirabilis has decided to keep the details of ICQ's protocol
proprietary and closed, this is mostly speculation, but I suspect it
to be accurate speculation.]

Diamond Joe Quimby <stali@alcor.concordia.ca> wrote:
>Anyone had any luck using icq over a slirp connection? I keep on receiving
>an "unable to connect message"

The reason for this is that SLIrP is only a simulation of a ppp/slip
connection. In particular, outgoing connections work, and incoming 
connections do not. 

The "ICQ server(s)" at Mirabilis functions in some regards similar to
a nameserver -- when one person needs to `reach' another with ICQ, the
originating client (O) asks the server(S) where to find the recipient (R).
S then reports R's IP address to O, and O does one of two things, either
connecting to R (somewhat implausible and dangerous) or requesting a
connection from R (more plausible, similar to the operation of DCC in
IRC.)

What is happening when you use ICQ is that either the server tries to
make a connection to your client, or another client tries to make a
connection to your client (after your client requested a connection, 
see above). Since, through SLIrP, your address appears to the 'net to
be alcor.concordia.ca, the server or other-client tries to connect to
some high port on alcor, but nothing is listening there.

This is also why server software won't work over SLIrP, by the way. As
for ICQ, consider it a blessing -- I've seldom seen a poorer-thought-out
and horribly-implemented protocol (insert NFS joke here). On top of that,
it's proprietary, so the vulnerabilities can't even be found easily.

There's a compendium of posts from the BUGTRAQ mailing list (and one from 
the usenet group alt.sysadmin.recovery) explaining why ICQ is less
than secure at <http://alcor.concordia.ca/~rich/icq/>. For those that
will read it and continue using it, at the *very* least, do not use
your ICQ password for *anything else at all*.

  -Rich  

-- 
Rich Lafferty ---------------------------------------------------------
IITS/Computing Services     |      
Concordia University        |    Nothing sucks like a Vax! (tm)
rich@vax2.concordia.ca -----------------------------------------[McQ]--