51–60 of 60 posts
Uhh, what's this about? https://i.imgur.com/e3kNYTH.png
I haven't worked at US government so I am not 100% sure of the details, but this is my understanding: HTTPS (tls, really) allows clients to present a certificate, just like the server does. This is commonly used, eg, for microservices authenticating to each other in a backend. It is less commonly used for people to authenticate to servers. In particular, the "Common Access Card" is the ID badge used by the DoD, vario…
Earlier quoted context omitted.
Probably to crowd source maintenance like nearly every other closed to open transition. And ghidra has been leaked a few times (they give it out like candy to contractors) so they're not really losing much.
any reports on if it's better than IDA?
My brother is into reverse engineering, he is literally counting the days to the open source release of this. He said there isn't anything quite like it as it can actually stand toe-to-toe with IDA Pro, the commercial software that apparently nothing yet can really beat.
Yup. IDA Pro is the gold standard, and was basically the only choice for a long time. It's also stupidly expensive and priced for defense contractor funny money, with an individual license nearly $3000 [0]. Most freelancers just use a cracked copy or the freeware version. Recently Hopper and BinaryNinja have been rising in use, with much more affordable pricing plans, but they're still second-rate as far as I know. (…
I have never used IDA Pro but maybe the licensing comes with some sort of support agreement?
NSA releasing an open-source tool? My first thought is, better subject it to serious, in-depth security review before installing it locally. Even then, build it from source.
Apache NiFi was also released by the NSA & has seen commercial success in the enterprise.
Earlier quoted context omitted.
Apache NiFi was also released by the NSA & has seen commercial success in the enterprise.
Wans't Tor initially developed by NSA/CIA as well?
https://en.wikipedia.org/wiki/Tor_(anonymity_network)#Histor...
Earlier quoted context omitted.
You'd have to audit the source code first, though, which is not a trivial thing to do.
exactly my point. When they released SELinux this was the argument and how many lines of code does an OS have?
Harder to meter: how understandable is the code? More verbose, but more easily understandable code will be far easier to audit.
Personally, I'd rather a million lines of code that are clear and obvious than 500k that are obtuse, terse and/or obfuscated.
Earlier quoted context omitted.
Yup. IDA Pro is the gold standard, and was basically the only choice for a long time. It's also stupidly expensive and priced for defense contractor funny money, with an individual license nearly $3000 [0]. Most freelancers just use a cracked copy or the freeware version. Recently Hopper and BinaryNinja have been rising in use, with much more affordable pricing plans, but they're still second-rate as far as I know. (…
I don't understand why you think 3000$ per seat is asking too much. If there's a market for cheaper products just build it. After putting in the work, you might actually think 3000$ is cheap. I have never used IDA Pro but maybe the licensing comes with some sort of support agreement?
Note that $3000 lacks the decompilers, of which there are 5 available. The total price with all of those is about $15,000.
Earlier quoted context omitted.
I don't understand why you think 3000$ per seat is asking too much. If there's a market for cheaper products just build it. After putting in the work, you might actually think 3000$ is cheap. I have never used IDA Pro but maybe the licensing comes with some sort of support agreement?
Yes, the support is excellent. Sometimes they will even email you a new version with your requested bug fix. Note that $3000 lacks the decompilers, of which there are 5 available. The total price with all of those is about $15,000.
Earlier quoted context omitted.
Air gapped RE machines (recall you're probably looking at malware anyway). One way transfer of samples. Print reports and OCR. Done.
Is printing and OCRing actually a thing? I'd think you would at least just point the camera (aka scanner) at a screen...