131–140 of 425 posts
edit: Oh, outside contributors of course retain their own copyright. That's what's licenced.
https://github.com/NationalSecurityAgency/ghidra/blob/master...
Why this is important (for those uninitiated): - Ghidra is basically the first real competitor to IDA Pro, the extremely expensive and often pirated state-of-the-art software for reverse engineering. Nothing else has come close to IDA Pro. - Ghidra is open-source, IDA Pro is not. - Ghidra has a lot of really cool features that IDA Pro doesn't, such as decompiling binaries to pseudo-C code. - It's also collaborative,…
Think BinaryNinja has been acting pretty effectively as a competitor to IDA Pro. Its much cheaper than IDA, has a good API and I have been a very happy customer.
Earlier quoted context omitted.
It's a funny situation, though: decompilation probably should cost a small fortune. If you're in a line of work that needs it, the quality of your decompiler is probably a huge factor in how valuable an hour of your time is, and many [most?] fields where people routinely decompile stuff are very highly compensated. IDA has always had a weirdly low price point given the bill rates of people who use it, and it's intere…
All software should be free, The marginal cost of one more user is exactly zero
Earlier quoted context omitted.
IDA Pro is not expensive at all for serious professionals in the field. Other common software in the industry costs way more. Nessus is $2k a year, Metasploit like $1500 to $15000, and Core Impact is $30k and up. If this is expensive to you, then it’s not for you. This is for people who are making real money with these tools, not hobbyists dicking around.
> If this is expensive to you, then it’s not for you. This is for people who are making real money with these tools, not hobbyists dicking around. That's an odd perspective. Imagine if this type of sentiment were applied to paint brushes. There is a lot of useful work that is not economically viable per se, and to discount that and to be pejorative feels wrong.
Not necessarily nice, but it makes sense.
Earlier quoted context omitted.
For which they charge a per-CPU fortune https://www.hex-rays.com/cgi-bin/quote.cgi
It's a funny situation, though: decompilation probably should cost a small fortune. If you're in a line of work that needs it, the quality of your decompiler is probably a huge factor in how valuable an hour of your time is, and many [most?] fields where people routinely decompile stuff are very highly compensated. IDA has always had a weirdly low price point given the bill rates of people who use it, and it's intere…
In the past, the same could have been said of compilers and even web server and mail server software.
> many [most?] fields where people routinely decompile stuff are very highly compensated.
If it's more freely available, and more people have experience with it, then the compensation might go down as the supply of people with this experience goes up. I'm not sure using salary as a justification of what a tool price should be makes a whole lot of sense. to me, it just sounds like an inefficient market because there's not enough competition (justification on the ground that it does much more than any competitor and thus can command a premium does though).
I'm curious what feature specifically prompted the NSA to develop their own IDA Pro alternative. I mean, someone somewhere at the NSA must have been trying to do something with IDA Pro only to repeatedly fail before the decision was made that whatever the NSA was trying to do warranted developing their own IDA Pro... right? Or perhaps they used IDA Pro so often and grew so frustrated by it that they started their own…
But it's also possible this is just sort of a labor of love type thing.
I wonder how this compares to retdec, an open source cross-architecture decompiler by Avast. https://github.com/avast-tl/retdec
Earlier quoted context omitted.
I think you're underestimating the value of intel on people who know how to get intel or at least interested in the topic.
It's part of the NSA's recruiting push. "If you are interested in projects like this ... consider applying" is even mentioned in the README. There's zero chance there's some secret trojan, because the people who are interested in this type of software are the exact people who would be able to find it.
Earlier quoted context omitted.
It's a funny situation, though: decompilation probably should cost a small fortune. If you're in a line of work that needs it, the quality of your decompiler is probably a huge factor in how valuable an hour of your time is, and many [most?] fields where people routinely decompile stuff are very highly compensated. IDA has always had a weirdly low price point given the bill rates of people who use it, and it's intere…
> It's a funny situation, though: decompilation probably should cost a small fortune. In the past, the same could have been said of compilers and even web server and mail server software. > many [most?] fields where people routinely decompile stuff are very highly compensated. If it's more freely available, and more people have experience with it, then the compensation might go down as the supply of people with this…
I'm not arguing that a capable free alternative is a bad thing. I think there's an industry business case study in what Hex-Rays could have done to keep this from happening, though.