Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IDA cybersecurity software provider Hex-Rays acquired

smartfinvc.com

Post reply on HN
Print view View original

21–30 of 116 posts

Re: IDA cybersecurity software provider Hex-Rays acquired

#21

Post by tptacek »

pseudo0 wrote: post #20
tptacek wrote: post #17

Earlier quoted context omitted.

It's roughly the cost of a very good Macbook, right? Many companies that employ the kinds of people who spend their days in IDA don't bat an eye at the cost of the laptops.

Around $3k for a one year floating license, then $4k per architecture, at least according to this price list: https://www.componentsource.com/product/ida-pro-hex-rays-dec...

That's for floating licenses, though, which are like 2x the price of the fixed and named licenses, right?

IDA has a problem where, for some shops, it really makes sense to just have one concurrent IDA user, because IDA is like 10-15% of the work hours --- but it's a critically important 10-15%. So they're super careful to charge for the ability to rotate a team of consultants through the same IDA license.

We had a client, a decade or so ago, that brought us in to do IDA-based vulnerability research work. We wrote some blog posts about the work, and it was so unusual for any of their clients to have that licensing arrangement that IDA (this is in the Pierre era, not the Hex-Rays era) publicly accused us of pirating our copy (which was annoying, because we couldn't out our client, but they absolutely did have the licensing worked out for this.)

It's all super off-putting. But IDA is in sort of a bind, because there just aren't that many users for their ultra-hyper-specialized product. You can have the very best decompiler in the world and you're still going to be a rounding error compared to companies like Figma, because (1) not that many people use disassemblers and (2) less and less software is written in C/C++ every year.

Re: IDA cybersecurity software provider Hex-Rays acquired

#22

Post by duskwuff »

mike_d wrote: post #11
stolen_biscuit wrote: post #7

Does anyone know what impact if any the release of Ghidra had on Hex-Rays? IDA never really accommodated to the hobbyist, so I wonder did it have any impact on the commercial side of things apart from the IDA Home release?

Very little. Everyone who was passing around pirated copies of IDA continued to do so before and after the release of Ghidra. More than anything I think binary.ninja started to eat their lunch because it was a far superior experience and up front reasonable pricing. Hex-Rays did ultimately release IDA Home, but you have to sign up for an account to even find out what their hobbyist license costs. I cannot underscore…

> Hex-Rays did ultimately release IDA Home, but you have to sign up for an account to even find out what their hobbyist license costs.

And even then, IDA Home comes with some pretty serious limitations. It's not just a no-commercial-use version of IDA Pro; it's also a cut-down version with no decompiler, no batch mode, and which only disassembles code for one processor family (which you have to choose at the time of purchase, from a limited subset of what IDA Pro supports).

Re: IDA cybersecurity software provider Hex-Rays acquired

#23

Post by pseudo0 »

tptacek wrote: post #21
pseudo0 wrote: post #20

Earlier quoted context omitted.

Around $3k for a one year floating license, then $4k per architecture, at least according to this price list: https://www.componentsource.com/product/ida-pro-hex-rays-dec...

That's for floating licenses, though, which are like 2x the price of the fixed and named licenses, right? IDA has a problem where, for some shops, it really makes sense to just have one concurrent IDA user, because IDA is like 10-15% of the work hours --- but it's a critically important 10-15%. So they're super careful to charge for the ability to rotate a team of consultants through the same IDA license. We had a cl…

It's not that much cheaper. $1,935.50 for a one year fixed or named license, then $2,709.70 per architecture. Let's say you need the typical four for x86 and ARM, that's over $12k per seat. A lot of companies would balk at that.

Re: IDA cybersecurity software provider Hex-Rays acquired

#24

Post by tptacek »

pseudo0 wrote: post #23
tptacek wrote: post #21

Earlier quoted context omitted.

That's for floating licenses, though, which are like 2x the price of the fixed and named licenses, right? IDA has a problem where, for some shops, it really makes sense to just have one concurrent IDA user, because IDA is like 10-15% of the work hours --- but it's a critically important 10-15%. So they're super careful to charge for the ability to rotate a team of consultants through the same IDA license. We had a cl…

It's not that much cheaper. $1,935.50 for a one year fixed or named license, then $2,709.70 per architecture. Let's say you need the typical four for x86 and ARM, that's over $12k per seat. A lot of companies would balk at that.

I've long since lost track of the pricing here, but the per-arch stuff is for the decompiler, right?

Re: IDA cybersecurity software provider Hex-Rays acquired

#25

Post by pseudo0 »

tptacek wrote: post #24
pseudo0 wrote: post #23

Earlier quoted context omitted.

It's not that much cheaper. $1,935.50 for a one year fixed or named license, then $2,709.70 per architecture. Let's say you need the typical four for x86 and ARM, that's over $12k per seat. A lot of companies would balk at that.

I've long since lost track of the pricing here, but the per-arch stuff is for the decompiler, right?

Yeah, that's for the decompiler. And I just saw your edit and agree that they are in a tricky spot. Their product is hyper-specialized and they deserve to get paid for the craft and expertise that they have put into their product, but at the same time they have been a significant barrier to entry for people getting into SRE due to the prohibitive cost. Their new offering of a limited license for $365 a year is a step in the right direction, but they only took that step after competition forced their hand.

Edit: Ironically the NSA is the entity commoditizing their complement here, getting an in-house SRE tool and making it easier to hire students out of college with skills they want.

Re: IDA cybersecurity software provider Hex-Rays acquired

#26

Post by Test0129 »

pseudo0 wrote: post #8

Hopefully this works out for Hex-Rays, allowing them to invest more into developing IDA and expanding their low-cost product offerings. The general sentiment I have seen among people doing SRE is that IDA is rapidly losing market share to Ghidra. While it excels in some areas, the licenses are pricy even for tech employers, and entirely out of reach for students or colleges. It's hard to convince an employer to fork…

I am not going to hold my breath on extending their hobbyist offerings.

I own a copy of IDA (legally). It was an absolute pain to purchase and it seems that a large portion of their margins are dedicated to piracy control. I won't detail the process...but it seems unusually personal.

If I had to guess they will expand their decompilers (the actual flagship project). It will be years before Ghidra + a community catch up to them and Binary Ninja (I also own a copy of it) may never. The disassembler is just a familiar tool. Their decompilers are way, way far ahead.

Re: IDA cybersecurity software provider Hex-Rays acquired

#27

Post by tptacek »

pseudo0 wrote: post #25
tptacek wrote: post #24

Earlier quoted context omitted.

I've long since lost track of the pricing here, but the per-arch stuff is for the decompiler, right?

Yeah, that's for the decompiler. And I just saw your edit and agree that they are in a tricky spot. Their product is hyper-specialized and they deserve to get paid for the craft and expertise that they have put into their product, but at the same time they have been a significant barrier to entry for people getting into SRE due to the prohibitive cost. Their new offering of a limited license for $365 a year is a step…

Sure! Don't get me wrong: they an extremely off-putting company. I just think I get where they're coming from.

Re: IDA cybersecurity software provider Hex-Rays acquired

#28

Post by bpye »

bri3d wrote: post #16
mike_d wrote: post #11

Earlier quoted context omitted.

Very little. Everyone who was passing around pirated copies of IDA continued to do so before and after the release of Ghidra. More than anything I think binary.ninja started to eat their lunch because it was a far superior experience and up front reasonable pricing. Hex-Rays did ultimately release IDA Home, but you have to sign up for an account to even find out what their hobbyist license costs. I cannot underscore…

I disagree with this for a non-direct sales reason: before, you learned IDA, cracked or not. If you learned to reverse software of any kind, you acquired IDA. Now, more and more tutorials and introductions use Ghidra. Is it better than IDA? In some cases yes, in most not yet, but it’s easier to get. If I were Hex-Rays, I’d be very concerned with a generational shift as people stop bothering to pirate IDA and those wh…

It's also really quite easy to add at least basic support to Ghidra for extra targets. I for example got quite far writing a TMS7000 [0] target for Ghidra [1] to reverse engineer the firmware for a TI teletype... though I still haven't dumped the ROMs to actually get further with it.

[0] - http://www.bitsavers.org/components/ti/TMS7000/TMS7000_Famil...

[1] - https://github.com/benpye/tms7000

Re: IDA cybersecurity software provider Hex-Rays acquired

#29

Post by ylk »

tptacek wrote: post #13
mike_d wrote: post #11

Earlier quoted context omitted.

Very little. Everyone who was passing around pirated copies of IDA continued to do so before and after the release of Ghidra. More than anything I think binary.ninja started to eat their lunch because it was a far superior experience and up front reasonable pricing. Hex-Rays did ultimately release IDA Home, but you have to sign up for an account to even find out what their hobbyist license costs. I cannot underscore…

They were, according to this, doing 20MM in 2020, which is surprisingly high for something like IDA. I think they mostly just don't want people like us as clients.

If you translate this article you’ll see that they didn’t just do 20 million in revenue, they made 18 million in profit with 18 employees, 11 of them being devs: https://archive.ph/Abxqp
Post reply on HN