Skype has had its share of bad news lately, with a malware attack following close on the heels of a massive outage. Current events raise questions about Skype’s technology that won’t — and shouldn’t — go away.

One is the perennial architecture question: proprietary (Skype) vs. open (SIP). Recently I asked SIP application company Counterpath’s CTO Jason Fischl to talk about it. Fischl was also the architect of TelTel’s SIP-based VoIP system.

“When you’re trying to design a system to scale there are two places you can have a problem: design of the protocol or in a bug in the implementation,” he explains.

And quite simply, in protocol design as in so many of life’s other arenas, numbers count.

“In the case of SIP we have protocol design by people who’ve been designing telecom protocols for many years.” People like Cisco and Nortel telecommunications engineers, who have generations of experience with the problems that can crop up in communications networks.

“In the case of Skype, they have a very small group,” he continues. “The advantage [for Skype] is that they can make it simple. But a lot fewer people are looking at it. It’s a monoculture. The same group of people are making all the decisions — and the decisions are made for tactical reasons rather than technical reasons.”

And then there’s implementation execution. Here, too, more is better.

“When you see the problems Skype had, you see the advantages of SIP. In the case of SIP, you’ve got hundreds — even thousands — of implementations. Lots of service providers implement SIP. Any problem they have isn’t going to affect the entire population — just their customers. Lots of different vendors implementing is a nice benefit.

“But the consequences of a flaw in the case of Skype — it’s a catastrophe,” adds Fischl. “There are no other implementations.”

Fischl suggests that Skype’s outage may have had more to do with the centralized aspect of Skype’s architecture than the peer-to-peer dimension. “One of the [problematic] things about their [Skype’s]architecture is that the authorization of users is done on a central server. That leaves open a vulnerability.”

SIP, by contrast, has a distributed authorization process. “It relies on an overlay network. You make a query into the overlay network and find out how to contact subscribers.”

Further, the IETF’s — Internet Engineering Task Force — peer-to-peer SIP working group is looking at an architecture that will do complete peer-to-peer SIP without a server at any point.

“One of the fundamental requirements is that you won’t need a central server when you login — only when you sign up. The consequence is that if servers went down you wouldn’t get new customers, but customers can still make calls.”

Fischl confesses to being puzzled that Skype hasn’t embraced SIP. “To being with, they’ve already got SIP gateways — why not go further down the road? I think if they took that approach — augment the network, let any SIP endpoint connect — they’d have a huge network of vendors building devices.

“Who knows?” Fischl adds, “Maybe they’re going down that road.”

The most entertaining explanation I’ve heard about last week’s Skype outage is this posting from Rostislav Siryk in his blog:

“Skype’s outage is …[a] natural consequence of quantum physics. Because users [are] like atoms.”

In other words, it’s within the realm of possibility that all the world’s PCs will download a Microsoft update and reboot at the identical moment.

On the other hand, when was the last time you saw an object move by itself as a result of all its atoms just happening to tip the same direction?

I thought so. That’s why many are saying Skype’s explanation, issued this morning, is fishy.

Certainly, no one at Skype or Ebay is saying much. My request for a real live conversation last week was answered politely with a copy of the company’s then-current statement and a link to the Skype blog. As Skype has talked with me openly in the past, it’s thought provoking at the very least.

But this discussion begs the question. Even accepting the Microsoft-did-it explanaon, the outage is nonetheless an object lesson for the entire VoIP industry of another immutable natural law: Murphy’s.

It highlights a fundamental industry problem, says VoIP gray-beard Erik Lagerway. Providers ultimately don’t control the underlying network that delivers their service.

“I’ve been in this business 15 years and over that time VoIP has been in beta 15 years. The main reason is that the network that people are riding on is unreliable,” says Lagerway, whose VoIP pedigree includes executive roles at Shift Networks and Eyeball Networks as well as founding Vocalscape Communications and Xten Networks (now Counterpath).

Unless a provider owns the upstream broadband network, a ‘best effort’ service is all a provider can promise, according to Lagerway.

“If the upstream provider has decided they’re going to be making some changes, you’re going to be feeling those changes. If the upstream provider decides they want to filter out [other providers’ VoIP] packets or handle them with less priority than their own packets, you’re going to experience that regardless of what kind of service you have.

“If they decide they’re going to route packets to Istanbul, they can do that,” he says, adding, “The long and short of it is that the incumbents have their long arm deeply inside the network.”

Having said that, Lagerway does allow that Skype’s proprietary peer-to-peer (P2P) architecture – a closely guarded “black box” — leaves the system unnecessarily vulnerable in a way that conventional centralized services like Vonage don’t.

“My main issue with Skype is that it’s a closed system,” says Lagerway, an outspoken evangelist for the open communications standard, SIP. “Having one guy [Janus Friis] create the entire peer-to-peer architecture, it’s destined to fail – no one is smart enough.

“What’s going to happen when the next Windows update comes along? What this says is that, at any given moment, Microsoft can screw over every single Skype user. That’s a serious problem. The fact that no one even thought of this is mind-boggling.”

Lagerway points to Skype’s implementation – a self-organizing P2P network operating exclusively on users’ PCs – as untenable for providing a service to millions of users.

“To have such a dependency on so many people’s PCs, that’s pretty risky business. What happens if a whole lot of people decide to de-install?”

A better approach for a P2P network is an architecture that fails back to a centralized client-server network – the way TelTel’s P2P VoIP network operates, for example. “That’s the way SIP operates,” Lagerway explains. “It’s a peer-to-peer network but it bootstraps the operation with a client-server network.”

In the end, while no one can ever fully escape Murphy’s Law, a more open approach could have helped Skype avert this particular disaster, Lagerway says.

“If this [Skype] had been an open standards projects, you would have had much more peer review. If they had used SIP, this particular outage would have been less likely. It could have possibly been averted,” he explains. “Correcting it now is going to be costly.”

The legendary Murphy could have told Skype that, too.

By year end Blackberry users will have a new WiFi-enabled dual-mode device. Here.

This week Avaya debuts a new SIP-based PBX system for distributed businesses featuring low-cost VoIP phones. Here.

Network World has a cautionary tale today about how Argonne Labs ended up replacing its green field VoIP implementation with a TDM system because of problems with the Cisco handsets. Author Paul Desmond offers a detailed case study. Here.

Can I tell you a secret? I’ve never actually launched a softphone program on my computer.

I was starting to feel like a Luddite. Then I read about Cambridge, England-based Camrivox’s Flexor 500 IP phone, a desk phone that integrates with business applications like Microsoft Outlook and Salesforce.com.

You could call it the best of both worlds.

First off, it’s a great example of using the IP platform to do something that’s impossibly complicated with traditional telephony. At the same time, it points to the enduring value of the “appliance” approach.

Part of the benefit is a comfortable and familiar form.

“General business people prefer to have a phone on their desks,” says Camrivox VP of Marketing David Moorhouse. “It [the Flexor 500] works in every respect like a phone and extends to desktop applications that people run every day.”

At the same time, a dedicated device can do the job better and more simply.

“Softphones have a lot of issues,” Moorhouse continues. “Getting them to work correctly, getting support, and vying for computer resources. There are QOS problems.”

Here’s how it works. When a call comes in, an Outlook window pops up showing who’s calling. To make a call, you simply click on the “call” button that Camrivox adds to the Outlook contact window. Flexor starts dialing and automatically goes to hands-free mode.

In addition, Flexor logs all your calls in Outlook Journal so you have a single, accessible record of calls. “It’s one place to keep track of everything,” Moorhouse adds.

The Camrivox Flexor 500 sells through distributors and retails for about US$120. It’s SIP-compatible, can be provisioned remotely and can be used with IP-PBXs and hosted VoIP services. You’ll be able to see it at the upcoming VON show, booth #950.

HP today announced its new smartphone, the HP iPAQ 500 Series Voice Messenger, that brings some real smarts to the world of smartphones.

The GSM/WiFi voice and data device is designed for business users rather than teenagers. It runs Microsoft Windows Mobile 6 and is geared for hands-free operation with a speech interface called “Voice Commander.” This lets the iPAQ replace the QWERTY keyboard with a familiar telephone keypad.

One of its most unique features is a voice-reply-to-email feature that eliminates the typing from answering email, something long overdue in the PDA world. This will clearly make mobile email more popular.

The iPAQ also integrates with any SIP-Based IP-PBX to eliminate the need for wired phones at those desks we never spend much time at anymore.

For IT managers, the gizmo provides over-the-air device-management capabilities for remotely managing security settings and applications, data, and corporate networks. This is a useful feature for dealing with lost or stolen phones.

The HP iPAQ will be available in the Spring of this year through HP directly and some dealers. A data sheet is available but HP hasn’t released any pricing. Some are saying the device will be in the $300-$400 range.