Open Source has been the plan for many years. It has been a long process, starting with determining which parts can be declassified. The current deal is some sort of FOUO, with government contractors able to run copies on non-networked computers but without all the extra high-security stuff.

This will be some interesting competition for IDA Pro, Binary Ninja (binja), and Hopper Disassembler. People with access to GHIDRA have been avoiding it because they prefer to develop skills with software that can be used at all employers, but soon that thinking will favor GHIDRA. IDA Pro is a few thousand dollars, and the other choices are a few hundred dollars.

Throwing r2 Cutter in the mix..

Radare as a project has some issues that may prevent it from having a large contributor base.

Oh, what issues?

The existence of this repository, for example https://github.com/radare/r2hate

In general, in the USA, anything that the US federal government makes is public domain copyright wise. For the NSA, there are obvious laws on secrecy for most of what it's doing, but they are different to copyright. Also, sometimes the US government is letting contractors write the software and if they license it, it obviously won't be public domain but the specific contractor will hold copyright.

This question has been explained a bit in a blog post by the pentagon [1]:

> While all of the work done by Federal employees remains in the public domain with no restrictions, public contributors enjoy the protections of widely adopted free and open source licenses. As projects mature, the aggregate work — with all the patches, bug fixes, and additional features — will fall under the license associated with the project.

[1]: https://medium.com/@DefenseDigitalService/code-mil-an-open-s...

Which I'd immediately use to reverse-engineer itself to see if there were any back doors. Of course they'd be expecting that, so I wouldn't find any.

My first 2 thoughts as well:) I suppose you'd need to RE it using a tool you trust. Might need to do that one, too. It's like a compiler trusting trust problem, but in reverse:)

It is a Java-based framework and most probably OSS. Coming soon on https://code.nsa.gov and github

Oh, if for nothing other than the irony of having to reverse engineer a tool for reverse engineering provided only in binary.