Rizin – a free and open-source Reverse Engineering framework

discussion on https://old.reddit.com/r/ReverseEngineering/comments/k996jq/...

Suggesting that this is some weird troll involving the internal politics of the Cutter project.

Looks like brew install gettext works.

This is a really well-designed page. The website is full of nice-looking graphics, good web design, and convincing demo material. That's interesting for a fork that was announced a couple days ago.

A story is missing here, and I think it should be told. Unfortunately, I don't know what it is. However, people don't spontaneously decide to fork a project, and the details here are too vague for a value judgment.

Firstly, I'd like to thank the project for doing actual tangible work before announcing a fork. If you are going to fork a project over internal disagreements, you have to understand and appreciate that the world doesn't have time to dig into literally 10,000 different project's internal affairs to try to guess which side of a fight to take; most people would prefer to let the contributors decide who wins by virtue of mindshare, and then pick the technically better project as a result. Rizin is off to at least some start here, having at least one major feature and some aspirations.

Firstly, why did this project start? To get a better idea of what's going on, let's analyze the timeline.

The project appears to have kicked off on October 1st, at least symbolically. The first PR seems to be a rename:

https://github.com/rizinorg/rizin/pull/2

What are the values of the Rizin org and what do they define as welcoming vs unwelcoming?

Since I don't know for sure, I can take a cursory glance at the types of PRs that exist within Rizin so far.

- Use Meson for macOS CI #3 -- A CI related change.

- Other renames in man and small places #4 -- Looks like more renames. Was pushed manually to master for some reason? Note also that it seems the primary branch has been renamed from 'master' since it was mentioned in this PR.

- Use R2PIPE_* -> RZ_PIPE_* env vars #5 -- More radare->rizon renames.

...

- Import patches #10 -- First import of Radare2 patches that I have noticed.

...

- Add new Projects Implementation #12 -- First major feature I can find.

...

- Create CODE_OF_CONDUCT.md #93 -- The project gains a code of conduct. Arguably the first interesting change that demonstrates the values of the project in some form.

...

- Change the "anal" abbreviation to "Analysis" in Code #117 -- December 6th. Interestingly, the source branch 'no-more-anal', reads a lot like a joke of a similar fashion to what is apparently unacceptable. This PR is the next change that demonstrates the values of the project.

- Add a fortune #118 -- "Rizin is the vegan pineapple pizza of reverse engineering tools." That's funny. I wonder if that's a bit of tongue-in-cheek self-awareness about the optics of forking a project over "ideological" disagreements.

...Ultimately, most of the PRs fall into the category of:

- 21 PRs: CI/infrastructure changes.

- 18 PRs: importing Radare2 changes.

- 9 PRs: renaming Radare2 -> Rizin

...of the 100 or so PRs. A lot of the others are minor changes like documentation updates, but it's hard to enumerate them into groups easily.

After surveying the PRs, it is no clearer exactly what motivates the project.

Searching through Radare PRs get no closer. Looking for PRs from around the time the project is created, I don't see many points of contention. I see some other discussions about fortunes but really not many. Searching through issues, much doesn't stand out. Fortunes doesn't appear to come up much in issues, with the search returning nothing from this year.

---

With that excavation out of the way, I'd like to turn my attention to the claim that Rizin is made up of "core Radare2 developers." This should be relatively easy to confirm. Firstly, we can look at the developers listed in AUTHORS.md:

    Mentors and co-maintainers
    --------------------------

    Most active in community, setting up CI servers, regression tests, esil, coverity, blog, release notes, ..
    
     - xvilka
     - condret
     - crowell
     - jvoisin
     - maijin

Now we can look at the top 5 contributors to Radare2 on Github:

- user "radare", apparently goes by the alias pancake, seems to be the primary maintainer. Very active all the way from 2010 to 2019, where things seem to have tapered a bit. 12,040 commits, 1,308,025 ++, 911,136 --

- user "alvarofe", was active during a couple of years, is mentioned specially in the AUTHORS.md file. 852 commits, 52,922 ++, 43,348 --

- user "XVilka", pretty active since around 2013. 834 commits, 92,857 ++, 54,658 --

- user "kazarmy", active since 2017. 779 commits, 24,498 ++, 17,779 --

- user "ret2libc", with a somewhat sporadic looking graph with pretty large activity spikes since 2015 or so. 673 commits, 170,629 ++, 89,518 --

Alright. Now onto the Rizinorg team on GitHub, it is comprised of the following members:

- user "ITAYC0HEN," Itay Cohen.

- user "kazarmy," Khairul Azhar Kasmiran.

- user "ret2libc," Riccardo Schirone.

- user "thestr4ng3r," Florian Märkl.

- user "wargio," Giovanni.

- user "XVilka," Anton Kochkov.

Some notes to make:

- "radare" aka pancake is not present. Obviously, otherwise it would beg the question why a fork is needed.

- "xvilka" is one of the contributors who was specially called out in the README as a core contributor.

- All of these developers were contributors to radare2 who contributed more than minor bits. This is a good sign for Rizin, of course.

So not every core developer is involved in Rizin, but the Rizin team has plenty of developers who have worked a lot on Radare2.

---

The next aspect that's interesting is Cutter moving over. Who works on Cutter? There is no similar AUTHORS.md in Cutter, however it is in the Rizin org now. This is interesting. I think this may have been the last step before launching Rizin. You can see that it appears Cutter was under Radareorg until very recently:

https://web.archive.org/web/20201208101941/https://github.co...

Further, we can look at the top Github contributors:

- user "thestr4ng3r", Florian Märkl. 558 commits, 47,091 ++, 49,926 --

- user "xarkes" - do not appear to be terribly active anymore. 364 commits, 47,370 ++, 55,610 --

- user "ITAYC0HEN," Itay Cohen. 196 commits, 12,434 ++, 5,895 --

- user "karliss," 165 commits, 22,387 ++, 11,620 --

- user "fcasal," 83 commits, 6,327 ++, 823 --

Notably, thestr4ng3r and ITAYC0HEN are also part of the Rizinorg team. karliss is not despite seeming to be a major part of maintaining Cutter up until recently.

It looks like Cutter operated the Rizin changes in private for some reason, until relatively recently. You can see evidence of this here:

https://github.com/rizinorg/cutter/pull/2496/files

which I find interesting.

---

All of this leaves me feeling very mixed. I don't feel we really know what the motivations for Rizin are.

The above-ground claim is that the reason why Rizin exists is due to an unwelcoming environment. Based on the kerfuffles with fortunes and renaming anal to analysis, I can only suspect that this is due to issues such as offensive language. However, the project was forked on October 1st before I can find much evidence of the fortunes problem, so it must've been brewing already. But what's weirder than that is that the fork was done by "thestr4ng3r," one of the primary developers of Cutter, who, as far as I can tell, does not seem to care that much about political correctness, at least based on the very tiny amount of information I can exact from these public channels, based on discussions that occurred after the fork had already begun:

https://github.com/radareorg/radare2/pull/17980

(An aside: I am not attempting to 'shame' anyone, just making observations based on publicly available information. Make your own judgements.)

That last part, "After the fork had already begun," is where things get interesting. It is possible that there were disagreements with pancake in private, or other bad conduct that I just happen to be missing, but above all I question the sincerity of the reasoning for this fork. I would like the maintainers to clarify what is going on here. Otherwise, it feels like there is some kind of power struggle going on, and that users are being roped into it without hearing the real reasons why. The stuff involving Cutter is especially interesting due to the fact that upstream Cutter is now based on Rizin, leaving Linux packagers with a fairly complicated conundrum that basically requires value judgements to resolve.

---

I can only imagine that somebody is going to be upset by some of what I'm doing here, but please understand that I am simply trying to figure out what is going on. I have a strong feeling that there might be a lot more going on here that will surface later on.

As far as attempts to fork a project based on non-technical disagreements, Rizin seems well-positioned, with control over Cutter and some core contributors on board.

Let's see what happens next...

For now, I am very likely to continue using r2, at least until Linux packagers decide to switch. They might as Cutter's choice is likely going to force the issue.

---

Yet another weird sidenote. I think PR #17980 discussion is full of interesting nuance.

User "FFY00," Filipe Laíns, created this PR. They appear to have contributed to Radare2 once in the past to add a small feature in 2017 (#9054.) They don't appear to have contributed to Rizin yet.

User "FFY00," Filipe Laíns says:

> @trufae this is what people are referring to when they criticize radare2. People are not out to get you, and do not hate radare2 just because... They are referring to this kind of behavior, which is harmful to others.

This is some solid evidence that there is some kind of reputation and pre-existing conflict regarding pancake's conduct (note that @trufae appears to be another Github account of pancakes?)

Continuing, user "FFY00," Filipe Laíns says:

> I don't understand how having these stupid sentences show up when you start the program is worth possibly hurting users.

This is a particularly strange sentence because they are, as far as I can tell, not shown at startup by default, and haven't been for years. In fact, their own commit description seems to be aware:

> Even if they are not active by default, they should have no place here if you are trying to be a welcoming project.

I have no idea what to conclude from this. It must just be an accident.

Sure, I'm not defending the situation, just offering a solution to your problem.