Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ghidra

nsa.gov

Post reply on HN
Print view View original

21–30 of 60 posts

Re: Ghidra

#21

Post by unknownknowns »

mcpherrinm wrote: post #12
amiga-workbench wrote: post #2

Uhh, what's this about? https://i.imgur.com/e3kNYTH.png

I haven't worked at US government so I am not 100% sure of the details, but this is my understanding: HTTPS (tls, really) allows clients to present a certificate, just like the server does. This is commonly used, eg, for microservices authenticating to each other in a backend. It is less commonly used for people to authenticate to servers. In particular, the "Common Access Card" is the ID badge used by the DoD, vario…

Client certificate PKI is common in this space. Even if it's just a local cert on the user's profile, it works really well as SSO.

Re: Ghidra

#22

Post by larkeith »

os2mac wrote: post #16

I'm still trying to figure out, in this day and age, especially after the Snowden disclosures, why anyone would trust software released by this organization. you do realize their primary goal is intelligence gathering?

It's a reverse engineering tool. The community is going to have plenty of ability to do network analysis on it. Also, it's trivial to sandbox it, even if it weren't going to be open-sourced.

Re: Ghidra

#23

Post by drchaos »

artemisbot wrote: post #18
os2mac wrote: post #16

I'm still trying to figure out, in this day and age, especially after the Snowden disclosures, why anyone would trust software released by this organization. you do realize their primary goal is intelligence gathering?

It's going to be an open source release so depending on your paranoia levels you could just build it yourself.

You'd have to audit the source code first, though, which is not a trivial thing to do.

Re: Ghidra

#24

Post by saagarjha »

larkeith wrote: post #22
os2mac wrote: post #16

I'm still trying to figure out, in this day and age, especially after the Snowden disclosures, why anyone would trust software released by this organization. you do realize their primary goal is intelligence gathering?

It's a reverse engineering tool . The community is going to have plenty of ability to do network analysis on it. Also, it's trivial to sandbox it, even if it weren't going to be open-sourced.

Sandboxing things is rarely trivial ;)

Re: Ghidra

#25

Post by Godel_unicode »

pm90 wrote: post #17
joshschreuder wrote: post #14

Earlier quoted context omitted.

I've always wondered this - there's a real "pay for your useful tools" philosophy on here at least, for things like Sublime Text. Often quoted is the cost per hour of use, etc. which justify the price (which is admittedly low compared to Ida). Does the same not apply to Ida where you would make the money back fast enough to justify the pricetag? Or is it that there are more hobbyists and less people making actual mon…

This is basically how a monopoly works. And the defense industry behaves like a monopoly even if its made up of a bunch of different companies.

I disagree, I think there's an important difference between a monopoly and a company that happens to have no competition at the moment. I think that active anti-competitive actions are one of the defining characteristics of a monopoly, and so far we haven't seen that behavior from hex-rays.

They had a significant barrier to entry protecting them, in that making a decompiler (the hex rays decompiler is the expensive part of "Ida") is hard, and the market is (was?) small.

Consider the difference between Standard Oil and Adobe. Photoshop was the only game in town not because Adobe lost money on it to drive out rivals but because it's hard to make software that does what Photoshop does.

Re: Ghidra

#26

Post by saagarjha »

chc4 wrote: post #10
slimsag wrote: post #5

My brother is into reverse engineering, he is literally counting the days to the open source release of this. He said there isn't anything quite like it as it can actually stand toe-to-toe with IDA Pro, the commercial software that apparently nothing yet can really beat.

Yup. IDA Pro is the gold standard, and was basically the only choice for a long time. It's also stupidly expensive and priced for defense contractor funny money, with an individual license nearly $3000 [0]. Most freelancers just use a cracked copy or the freeware version. Recently Hopper and BinaryNinja have been rising in use, with much more affordable pricing plans, but they're still second-rate as far as I know. (…

Yeah, IDA is simultaneously the worst piece of software I have used from a usability standpoint but also the best reverse engineering tool out there. The author basically does whatever he likes because most reverse engineers use it :(

Re: Ghidra

#27

Post by sheeshkebab »

saagarjha wrote: post #24
larkeith wrote: post #22

Earlier quoted context omitted.

It's a reverse engineering tool . The community is going to have plenty of ability to do network analysis on it. Also, it's trivial to sandbox it, even if it weren't going to be open-sourced.

Sandboxing things is rarely trivial ;)

in particular tools that are designed to reverse engineer things :)

Re: Ghidra

#28

Post by rzzzt »

G4BB3R wrote: post #15
slimsag wrote: post #5

My brother is into reverse engineering, he is literally counting the days to the open source release of this. He said there isn't anything quite like it as it can actually stand toe-to-toe with IDA Pro, the commercial software that apparently nothing yet can really beat.

Is IDA so superior to OllyDBG? What are the differences? I was into reversing in 2009/2010, was just a hobbist trying to crack some programs and making bots to some games.

OllyDbg never really stepped out of the 32-bit world; the author's progress reports of the x64 version end in 2014: http://www.ollydbg.de/odbg64.html

I'd like to know if someone is using x64dbg, however, which looks similar in appearance: https://x64dbg.com/

Re: Ghidra

#29

Post by saagarjha »

Godel_unicode wrote: post #25
pm90 wrote: post #17

Earlier quoted context omitted.

This is basically how a monopoly works. And the defense industry behaves like a monopoly even if its made up of a bunch of different companies.

I disagree, I think there's an important difference between a monopoly and a company that happens to have no competition at the moment. I think that active anti-competitive actions are one of the defining characteristics of a monopoly, and so far we haven't seen that behavior from hex-rays. They had a significant barrier to entry protecting them, in that making a decompiler (the hex rays decompiler is the expensive p…

Both Photoshop and IDA Pro treat their customers pretty poorly, but they work well so everyone uses it. Hence why people are excited to see competitors in the space.

Re: Ghidra

#30

Post by Godel_unicode »

mcpherrinm wrote: post #12
amiga-workbench wrote: post #2

Uhh, what's this about? https://i.imgur.com/e3kNYTH.png

I haven't worked at US government so I am not 100% sure of the details, but this is my understanding: HTTPS (tls, really) allows clients to present a certificate, just like the server does. This is commonly used, eg, for microservices authenticating to each other in a backend. It is less commonly used for people to authenticate to servers. In particular, the "Common Access Card" is the ID badge used by the DoD, vario…

I actually prefer the browser UX for client cert authentication; since it's presented by the browser it's harder to do nefarious things with JavaScript to confuse the user as to what site is requesting authentication.

Edit: for what it's worth, the executive agencies are all required to use PIV (essentially civilian CAC) to authenticate, and those PIVs are required to have significant physical controls including requiring a PIN for access. It's a pretty robust way of enforcing 2fa.

Post reply on HN