Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ghidra, NSA's reverse-engineering tool

nsa.gov

Post reply on HN
Print view View original

301–310 of 425 posts

Re: Ghidra, NSA's reverse-engineering tool

#301

Post by anyzen »

Brotkrumen wrote: post #233
dman wrote: post #199

Earlier quoted context omitted.

If you have any pointers to a company / individual making a living building open source tools for developers please let me know. (Working for a large cloud / OS provider that is subsidizing tool development as part of a platform play does not count).

>subsidizing tool development as part of a platform play does not count So you're excluding deploying/maintaining Open Source Software as a service. That basically excludes how Open Source is supposed to get monetized.

> So you're excluding deploying/maintaining Open Source Software as a service. That basically excludes how Open Source is supposed to get monetized.

Is it? This means that incentives would be wrong, because then developers would be incentivized to produce difficult to use (but useful!) software - with various poorly documented features, multiple ways to solve the same problems, poor and inconsistent UX... Oh wait...

I am sorry Redis labs got the heat for their license change and I really hope some solution crops up. I appreciate opensource, but I am getting tired of poorly implemented systems, just because there is no incentive to do it differently.

I think the solution lies in "free-to-use (but not free-to-sell), source available" licenses. I haven't seen one that would convince me yet, but I am certain that with big-tech companies behaving like they do, more and more developers will think twice before giving away their work for free just so others can make billions off it (and take away income from the very companies providing bread and butter to FOSS developers - coughAWScough).

Re: Ghidra, NSA's reverse-engineering tool

#302

Post by anyzen »

jazzyjackson wrote: post #221
forgingahead wrote: post #214

Earlier quoted context omitted.

Sidekiq charges for their Enterprise plan which starts at $179 per month, Redis offers paid Commercial Support. The money always comes from somewhere...

Yeah, the question was about getting paid to develop open source software. The answer is, sell support.

Wrong answer. Selling support means that the developer is incentivized to make product unnecessarily complex. Also, with recent developments it turns out that other entities might be better at providing support than original developers, taking away the option to monetize OSS. Why bother writing your own software, when you can just sell services and provide support for a different one?

Note that RedHat, often quoted as success story, is really a services company that just happens to write an occasional piece of software, and support them when their customers need it.

Re: Ghidra, NSA's reverse-engineering tool

#303

Post by mattigames »

Goz3rr wrote: post #269
OskarS wrote: post #250

Earlier quoted context omitted.

Yeah, my mouse was hovering over the download button eager to test it out when my brain suddenly went "wait, don't do that!" If you wanna run this thing, you should probably build it from source yourself (don't trust the binaries) and even then run it in a pretty well sandboxed virtual machine. I would not be surprised at all if the NSA left some surprises in that thing.

I hope you don't use Linux, because the NSA contributes to quite a lot of OSS. They also created SELinux for instance.

Those changes on OSS are reviewed by a lot of people, this here is just released and reviewed by themselves only.

Re: Ghidra, NSA's reverse-engineering tool

#304

Post by MileyCyrax »

pbhjpbhj wrote: post #265
paxys wrote: post #186

Earlier quoted context omitted.

They can also enforce copyright in other countries.

Can they? How's that work, surely a resident in USA could take the work to the other country and make it available, if they can't then it wasn't public domain in the first place? Can you point me to any caselaw/ analysis please?

I don't quite get it either, but one of their documentation files seems to imply that they can:

>In countries where copyright protection is available (which does not include the U.S.), contributions made by U.S. Federal Government employees are released under the License. Merged contributions from private contributors are released under the License.

https://github.com/NationalSecurityAgency/ghidra/blob/master...

Re: Ghidra, NSA's reverse-engineering tool

#305

Post by dman »

Brotkrumen wrote: post #233
dman wrote: post #199

Earlier quoted context omitted.

If you have any pointers to a company / individual making a living building open source tools for developers please let me know. (Working for a large cloud / OS provider that is subsidizing tool development as part of a platform play does not count).

>subsidizing tool development as part of a platform play does not count So you're excluding deploying/maintaining Open Source Software as a service. That basically excludes how Open Source is supposed to get monetized.

Not every niche is going to be covered by the benevolent interests of your local friendly cloud provider.

Re: Ghidra, NSA's reverse-engineering tool

#307

Post by lsiebert »

justinjlynn wrote: post #132
dman wrote: post #38

Earlier quoted context omitted.

Think BinaryNinja has been acting pretty effectively as a competitor to IDA Pro. Its much cheaper than IDA, has a good API and I have been a very happy customer.

It's not Open Source.

It's being released at RSA as open source, so it's more correct to say that it's not open source yet.

Re: Ghidra, NSA's reverse-engineering tool

#308

Post by dman »

krageon wrote: post #227
dman wrote: post #199

Earlier quoted context omitted.

If you have any pointers to a company / individual making a living building open source tools for developers please let me know. (Working for a large cloud / OS provider that is subsidizing tool development as part of a platform play does not count).

There are examples which other commenters have already given you, I see. What I'm curious about is why this matters; obviously we as users care about having open-source tooling (and we are in a thread discussing one such tool). Whether or not we can come up with examples of this off the cuff is completely immaterial to the constraint that proposed tools should be open-source.

The reason I asked the question was to find pointers to people to talk to about their experience making money off open source. I have been wanting to build tools in some domain and am struggling with how to monetize desktop based software tools in 2019.

Re: Ghidra, NSA's reverse-engineering tool

#309

Post by Eldt »

anyzen wrote: post #302
jazzyjackson wrote: post #221

Earlier quoted context omitted.

Yeah, the question was about getting paid to develop open source software. The answer is, sell support.

Wrong answer. Selling support means that the developer is incentivized to make product unnecessarily complex. Also, with recent developments it turns out that other entities might be better at providing support than original developers, taking away the option to monetize OSS. Why bother writing your own software, when you can just sell services and provide support for a different one? Note that RedHat, often quoted a…

There's a lot more going on than just incentives to make a product "unnecessarily complex". It's certainly a concern but many companies make it work. I judge this an acceptable answer, not a wrong answer.

Re: Ghidra, NSA's reverse-engineering tool

#310

Post by AsyncAwait »

nneonneo wrote: post #239
dman wrote: post #38

Earlier quoted context omitted.

Think BinaryNinja has been acting pretty effectively as a competitor to IDA Pro. Its much cheaper than IDA, has a good API and I have been a very happy customer.

Being open-sourced is a big advantage. I just fixed a bug in GHIDRA relating to trackpad scrolling which makes it MUCH more usable for me. I could never do the same with IDA or Binary Ninja. I do so love the shell code compiler of Binary Ninja, though. It works very well and has definitely saved me a lot of time.

Awesome! Please don't forget to submit it as a pull request once the code's on GitHub.
Post reply on HN