News for hackers. Stuff that matters.
Re:Ghidra, NSA's reverse-engineering tool by dman on Tuesday March 05, 2019 @07:34PM (#19315508)
Think BinaryNinja has been acting pretty effectively as a competitor to IDA Pro. Its much cheaper than IDA, has a good API and I have been a very happy customer.
Re:Ghidra, NSA's reverse-engineering tool by jjoonathan on Tuesday March 05, 2019 @10:41PM (#19316240)
And they didn't take my money, break my key in an update, and ghost me while I was still in the support period. So they've got that going for them.
Re:Ghidra, NSA's reverse-engineering tool by philpem on Wednesday March 06, 2019 @09:42AM (#19319212)
Did they ever tell you why they did that?

I'd like to hear the rest of this story, I was considering buying IDA Pro (though these days I'm having a lot of fun adding M68k support to Avast's Retdec)

Re:Ghidra, NSA's reverse-engineering tool by jjoonathan on Wednesday March 06, 2019 @10:23AM (#19319523)
No, they never replied at all. Their self-service site broke and they completely and utterly ignored my emails to the associated service address and to a number of other addresses posted on their site.

I grew up using, ah, other methods of satisfying my need for an interactive debugger and those methods continued to be viable after giving hex-rays $1100 and getting flaked, so I wasn't materially impacted by the flakery, even though I "should" have been. Had I been materially impacted rather than merely angered and frustrated, I probably would have tried other escalation paths -- phone, twitter, maybe even snail mail -- and I suspect I eventually could have gotten through, and my expectation absent evidence to the contrary is that if I were to have gotten through they would have helped me out. My takeaway would be "their self-service site is rubbish and they force you to use a company email address (as opposed to your gmail) and then their support email servers sometimes silently drop messages from your company email address, or something," not "they're crooks." On a professional app sold at a professional price, though, that's still not a good thing, and it informed my software choices going forward.

Re:Ghidra, NSA's reverse-engineering tool by ilfak on Tuesday March 12, 2019 @04:24PM (#19372621)
It is not our habit to leave emails from customers unanswered. The only explanation I see is that your email ended up in the spam folder.

Since I can not find your nickname in our database, I can not say more.

Re:Ghidra, NSA's reverse-engineering tool by psifertex on Wednesday March 06, 2019 @12:01PM (#19320488)
This is really strange to hear. What self service site did you use? Our website chat goes right to a slack channel that multiple folks monitor and reply to at all hours of the day. Worst case if we're all sleeping and you leave an email we respond when we're awake.

Just searched for your username in our chat and our email and don't see anything so I assume you've got a different email?

Re:Ghidra, NSA's reverse-engineering tool by jjoonathan on Wednesday March 06, 2019 @01:38PM (#19321338)
My problems were with an IDA Pro license I purchased from hex-rays. I have no complaints about BinaryNinja. If you represent hex-rays I'd be happy to PM you my business email.
Re:Ghidra, NSA's reverse-engineering tool by X-Istence on Wednesday March 06, 2019 @12:23PM (#19320700)
He's talking about IDA Pro.
Re:Ghidra, NSA's reverse-engineering tool by psifertex on Wednesday March 06, 2019 @11:59AM (#19320462)
I'm sorry you had a bad experience. This is the first I've heard about it! We normally get nothing but praise during any customer support interaction. Feel free to email me directly (jordan at vector35 com) with your email address so I can try to figure out what happened. Apologies it didn't go well.
Re:Ghidra, NSA's reverse-engineering tool by maerF0x0 on Wednesday March 06, 2019 @12:05PM (#19320528)
I think parent was saying that Binary Ninja _didnt_ do those things (implying that IDA did).
Re:Ghidra, NSA's reverse-engineering tool by jjoonathan on Wednesday March 06, 2019 @01:40PM (#19321363)
Yep.
Re:Ghidra, NSA's reverse-engineering tool by sundar4344 on Friday March 08, 2019 @12:43AM (#19335397)
Email privately and get noted for life. This is really annoying when some one complains publicly and they ask your to email in private. Why don't you go through the old emails and provide a solution.
Re:Ghidra, NSA's reverse-engineering tool by Nexxxeh on Sunday March 10, 2019 @08:50AM (#19351727)
Because it wasn't sufficiently clear to GPP that it was IDA Pro's support that was problematic. GPP incorrectly thought it was BinaryNinja support that was the problem, which isn't the case.
Re:Ghidra, NSA's reverse-engineering tool by psifertex on Wednesday March 06, 2019 @12:05PM (#19320530)
Oh also, just to clarify -- are you talking about Binary Ninja or something else? That would explain a lot of my confusion. :-P
Re:Ghidra, NSA's reverse-engineering tool by jjoonathan on Wednesday March 06, 2019 @01:39PM (#19321360)
I'm complaining about IDA. I have no complaints about BinaryNinja :-)
Re:Ghidra, NSA's reverse-engineering tool by psifertex on Thursday March 07, 2019 @02:03AM (#19326103)
Yeah, sorry for being slow on the uptake there. The negative threw me off. :-P
Re:Ghidra, NSA's reverse-engineering tool by nneonneo on Wednesday March 06, 2019 @03:23AM (#19317230)
Being open-sourced is a big advantage. I just fixed a bug in GHIDRA relating to trackpad scrolling which makes it MUCH more usable for me. I could never do the same with IDA or Binary Ninja.

I do so love the shell code compiler of Binary Ninja, though. It works very well and has definitely saved me a lot of time.

Re:Ghidra, NSA's reverse-engineering tool by AsyncAwait on Wednesday March 06, 2019 @08:25AM (#19318674)
Awesome! Please don't forget to submit it as a pull request once the code's on GitHub.
Re:Ghidra, NSA's reverse-engineering tool by nneonneo on Wednesday March 06, 2019 @01:14PM (#19321129)
Of course. In the meantime I posted patched binaries to the relevant issue: https://github.com/NationalSecurityAgency/ghidra/issues/2#is...

As soon as the code is up I hope to submit a PR, which will be pretty easy since I already have the diff.

Re:Ghidra, NSA's reverse-engineering tool by SEJeff on Wednesday March 06, 2019 @10:56AM (#19319837)
Re:Ghidra, NSA's reverse-engineering tool by pcwalton on Wednesday March 06, 2019 @02:29PM (#19321845)
Speak of the devil—I was just thinking about diving in to fix that issue. Thank you! :)
Re:Ghidra, NSA's reverse-engineering tool by justinjlynn on Tuesday March 05, 2019 @09:42PM (#19316035)
It's not Open Source.
Re:Ghidra, NSA's reverse-engineering tool by dman on Wednesday March 06, 2019 @12:57AM (#19316674)
If you have any pointers to a company / individual making a living building open source tools for developers please let me know. (Working for a large cloud / OS provider that is subsidizing tool development as part of a platform play does not count).
Re:Ghidra, NSA's reverse-engineering tool by Brotkrumen on Wednesday March 06, 2019 @03:14AM (#19317185)
>subsidizing tool development as part of a platform play does not count

So you're excluding deploying/maintaining Open Source Software as a service. That basically excludes how Open Source is supposed to get monetized.

Re:Ghidra, NSA's reverse-engineering tool by anyzen on Wednesday March 06, 2019 @07:28AM (#19318359)
> So you're excluding deploying/maintaining Open Source Software as a service. That basically excludes how Open Source is supposed to get monetized.

Is it? This means that incentives would be wrong, because then developers would be incentivized to produce difficult to use (but useful!) software - with various poorly documented features, multiple ways to solve the same problems, poor and inconsistent UX... Oh wait... </s>

I am sorry Redis labs got the heat for their license change and I really hope some solution crops up. I appreciate opensource, but I am getting tired of poorly implemented systems, just because there is no incentive to do it differently.

I think the solution lies in "free-to-use (but not free-to-sell), source available" licenses. I haven't seen one that would convince me yet, but I am certain that with big-tech companies behaving like they do, more and more developers will think twice before giving away their work for free just so others can make billions off it (and take away income from the very companies providing bread and butter to FOSS developers - coughAWScough).

Re:Ghidra, NSA's reverse-engineering tool by dman on Wednesday March 06, 2019 @08:10AM (#19318587)
Not every niche is going to be covered by the benevolent interests of your local friendly cloud provider.
Re:Ghidra, NSA's reverse-engineering tool by krageon on Wednesday March 06, 2019 @02:47AM (#19317078)
There are examples which other commenters have already given you, I see. What I'm curious about is why this matters; obviously we as users care about having open-source tooling (and we are in a thread discussing one such tool). Whether or not we can come up with examples of this off the cuff is completely immaterial to the constraint that proposed tools should be open-source.
Re:Ghidra, NSA's reverse-engineering tool by dman on Wednesday March 06, 2019 @08:22AM (#19318660)
The reason I asked the question was to find pointers to people to talk to about their experience making money off open source. I have been wanting to build tools in some domain and am struggling with how to monetize desktop based software tools in 2019.
Re:Ghidra, NSA's reverse-engineering tool by gorbypark on Wednesday March 06, 2019 @04:34PM (#19323061)
Evan You (creator of VueJS) makes ~$16k a month on Patreon, plus an untold amount of fees for speaking at conferences. They also have an open collective which at the momement has a budget of just under $67k/year. It's hard to say what the money is actually used for, but at least some is used to pay for "VueJS maintenance" which probably goes towards paying Evan as well.
Re:Ghidra, NSA's reverse-engineering tool by dman on Wednesday March 06, 2019 @04:50PM (#19323230)
Thanks for this information, it helps. The issue for me is that the target audience is probably < 10k people globally. The tool would act as a serious productivity multiplier for those 10k people (and those people are very well paid). In Evans case his creation is not only awesome, it also has a large target audience.
Re:Ghidra, NSA's reverse-engineering tool by kakarot on Wednesday March 06, 2019 @05:40PM (#19323667)
Re:Ghidra, NSA's reverse-engineering tool by DC-3 on Wednesday March 06, 2019 @01:12AM (#19316713)
KDE has full time developers.
Re:Ghidra, NSA's reverse-engineering tool by kfriede on Wednesday March 06, 2019 @01:11AM (#19316712)
Redis. Sidekiq.
Re:Ghidra, NSA's reverse-engineering tool by forgingahead on Wednesday March 06, 2019 @01:49AM (#19316824)
Sidekiq charges for their Enterprise plan which starts at $179 per month, Redis offers paid Commercial Support.

The money always comes from somewhere...

Re:Ghidra, NSA's reverse-engineering tool by ascorbic on Wednesday March 06, 2019 @01:59AM (#19316871)
Open source doesn't mean free.
Re:Ghidra, NSA's reverse-engineering tool by jazzyjackson on Wednesday March 06, 2019 @02:31AM (#19317001)
Yeah, the question was about getting paid to develop open source software.

The answer is, sell support.

Re:Ghidra, NSA's reverse-engineering tool by anyzen on Wednesday March 06, 2019 @07:34AM (#19318389)
Wrong answer. Selling support means that the developer is incentivized to make product unnecessarily complex. Also, with recent developments it turns out that other entities might be better at providing support than original developers, taking away the option to monetize OSS. Why bother writing your own software, when you can just sell services and provide support for a different one?

Note that RedHat, often quoted as success story, is really a services company that just happens to write an occasional piece of software, and support them when their customers need it.

Re:Ghidra, NSA's reverse-engineering tool by Eldt on Wednesday March 06, 2019 @08:24AM (#19318671)
There's a lot more going on than just incentives to make a product "unnecessarily complex". It's certainly a concern but many companies make it work. I judge this an acceptable answer, not a wrong answer.
Re:Ghidra, NSA's reverse-engineering tool by anyzen on Friday March 08, 2019 @06:19AM (#19336619)
> It's certainly a concern but many companies make it work.

They do? Maybe. But they are walking a thin line between their short term (make it complex so we can, you know, sell support) and long term (make it simple enough that people don't jump ship) commercial interests. This is the reason I call it "unnecessarily" complex - it is in the interest of companies who sell support services that the product is not as easy to use as it could be.

Do we really need this? I think not, and I actually prefer what Redis Labs, MariaDB and others have been doing with the licenses for their modules. Sure, Business Source license and similar are not open-source (as in "freedom to take the product you have built and sell services on top of it, driving you out of similar business as collateral damage"), but at least they provide developers with the incentive to produce easy to use software, and not just because they feel like it, but because they can actually earn their living from it.

There might be some exceptions that "make it work", but this is in spite of just selling services on top of their product, not because of it. The cards are stacked against them - it is much easier (and profitable) to take other persons' product and build on it that it is to build your own.

In my experience, selling support is an acceptable answer only in the eyes of would-be competitors. Otherwise it is just plain wrong. </rant>

Re:Ghidra, NSA's reverse-engineering tool by meditate on Wednesday March 06, 2019 @12:34PM (#19320787)
I don't see this as an incentive specific to FOSS. Most customers of any software tend to demand increasingly complex featuresets as time goes on.
Re:Ghidra, NSA's reverse-engineering tool by anyzen on Friday March 08, 2019 @06:22AM (#19336631)
The complexity is not specific to FOSS. The incentive as described however is.
Re:Ghidra, NSA's reverse-engineering tool by AsyncAwait on Wednesday March 06, 2019 @08:26AM (#19318681)
There are many, however that's not even relevant here, considering NSA is funded via tax dollars.
Re:Ghidra, NSA's reverse-engineering tool by blattimwind on Wednesday March 06, 2019 @03:06PM (#19322254)
JetBrains.
Re:Ghidra, NSA's reverse-engineering tool by jmull3n on Wednesday March 06, 2019 @01:54AM (#19316844)
Vue.js
Re:Ghidra, NSA's reverse-engineering tool by idlewords on Tuesday March 05, 2019 @10:25PM (#19316179)
You can just reverse-engineer it!
Re:Ghidra, NSA's reverse-engineering tool by justinjlynn on Tuesday March 05, 2019 @10:56PM (#19316286)
No, you almost certainly promised not to do so when you bought a licence.
Re:Ghidra, NSA's reverse-engineering tool by legitbs_ctf on Wednesday March 06, 2019 @12:04AM (#19316512)
That’s actually untrue - they explicitly give permission to reverse engineer their software in the license.

Check restrictions in https://docs.binary.ninja/about/license/index.html

Re:Ghidra, NSA's reverse-engineering tool by elliotec on Wednesday March 06, 2019 @01:00AM (#19316681)
For the lazy:

> Restrictions. Subject to applicable copyright, trade secret and other laws, you are permitted under this License to reverse engineer or de-compile the Software but you may not alter, duplicate, modify, rent, lease, loan, sublicense, create derivative works from or provide others with the Software in whole or part, or transmit or communicate any of the Software over a network in order to share it with others.

Re:Ghidra, NSA's reverse-engineering tool by justinjlynn on Wednesday March 06, 2019 @03:23AM (#19317228)
> create derivative works from

That's pretty much the only reason one would reverse engineer it, in this context - and it's somewhat misleading to suggest otherwise.

Re:Ghidra, NSA's reverse-engineering tool by guipsp on Wednesday March 06, 2019 @05:41AM (#19317892)
Most reverse engineering done nowadays is not for derivative works
Re:Ghidra, NSA's reverse-engineering tool by reitanqild on Wednesday March 06, 2019 @04:59AM (#19317684)
Hunting for bugs to report would be a valid, wouldn't it?
Re:Ghidra, NSA's reverse-engineering tool by justinjlynn on Wednesday March 06, 2019 @06:06AM (#19318002)
I'd rather just have the damn code.
Re:Ghidra, NSA's reverse-engineering tool by vectorEQ on Wednesday March 06, 2019 @07:22AM (#19318330)
that always of course :D
Re:Ghidra, NSA's reverse-engineering tool by BuildTheRobots on Wednesday March 06, 2019 @10:52AM (#19319794)
Not if you're oracle.
Re:Ghidra, NSA's reverse-engineering tool by BuildTheRobots on Wednesday March 06, 2019 @12:06PM (#19320539)
Can't edit but I'll reply: This was meant as more than a throwaway comment, please see the many discussions - Oracle's chief security officer got extremely upset by it.

https://www.zdnet.com/article/oracle-to-sinner-customers-rev...

https://news.ycombinator.com/item?id=10043432

Re:Ghidra, NSA's reverse-engineering tool by vectorEQ on Wednesday March 06, 2019 @07:22AM (#19318326)
thats for commercial purposes, and it's misleading to suggest otherwise.
Re:Ghidra, NSA's reverse-engineering tool by gpm on Tuesday March 05, 2019 @11:08PM (#19316335)
Ghidra on the other hand you could, since even if they never get around to fully releasing the source (unlikely) they still granted us an apache license on the whole thing :)

I think it's probably pretty unique right now in that it's under an OSS license without all the source available.

Re:Ghidra, NSA's reverse-engineering tool by MrMorden on Tuesday March 05, 2019 @11:28PM (#19316403)
All the source is in .zip files in the download. What's missing (and coming soon) is a build system.
Re:Ghidra, NSA's reverse-engineering tool by pcwalton on Tuesday March 05, 2019 @11:27PM (#19316401)
Ghidra is mostly Java, so decompilation would pretty high-fidelity to begin with.
Re:Ghidra, NSA's reverse-engineering tool by gpm on Tuesday March 05, 2019 @11:29PM (#19316406)
The java sources seem to all be there in zip files actually (as far as I can tell). The part I was most interested in atm (the decompiler) turns out to be some sort of native language compiled to an executable, and its source isn't there.
Re:Ghidra, NSA's reverse-engineering tool by lsiebert on Wednesday March 06, 2019 @08:17AM (#19318622)
It's being released at RSA as open source, so it's more correct to say that it's not open source yet.
Re:Ghidra, NSA's reverse-engineering tool by EE84M3i on Wednesday March 06, 2019 @10:09AM (#19319421)
This was in reference to Binary Ninja, which was neither released at RSA nor is Open Source.
Re:Ghidra, NSA's reverse-engineering tool by maccio92 on Wednesday March 06, 2019 @09:11AM (#19318978)
not everything in the world has to be open source
Re:Ghidra, NSA's reverse-engineering tool by birdiesanders on Wednesday March 06, 2019 @09:22AM (#19319078)
True, but we do need one of everything to be open source.