3 ms·

Interesting! I never imagined someone from DoD would respond to my quick analysis. In all fairness, JD-GUI wasn't exactly great at reversing the class file to

Interesting! I never imagined someone from DoD would respond to my quick analysis. In all fairness, JD-GUI wasn't exactly great at reversing the class file to Java code and missed quite a bit. I haven't had a chance to analyze it further. Is there any chance the DoD could open source this application (e.g. on Github, or some other site)?

fifteen_letters 10y ago
FWIW, a few bits of the Java source are generated from other languages. So if JD-GUI produces something that looks just freaky bizarre, the answer might well be that the actual Java source really does look like that, but that's not what "the original" file is written in, if that makes sense. Like 95% of the project is maintained in straight up Java, but things dealing with different crypto implementations, or features not available in the public release, are sometimes maintained "one level up". Full disclosure: I'm a contractor, not a DoD employee; as the maintainer I can safely speak for what the project was and is. But as to what the project will do in the future, all I can do is give you my best Magic Eight Ball guess. Namely: if it happens, it probably won't be soon. Most of us on the project are big believers in open source but convincing the higher-ups that it would be worth doing that for EW is a looooooooong undertaking. Going open source -- or making any other change to policy, or management, or whatever -- has to help the DoD solve the problems which this software was created to solve. It's not that the entire organization is against the idea of libre software -- AFRL is a research group, they get how good software development works -- it's just that their default position is "make no change" and any other approach has to show a demonstrable, concrete benefit over what they're already getting. In the meantime... well, the EW-Public license specifically allows decompiling, which everybody was going to do anyhow. :-) It's not the same, but it makes looking for vulnerabilities way easier.

fifteen_letters 10y ago

FWIW, a few bits of the Java source are generated from other languages. So if JD-GUI produces something that looks just freaky bizarre, the answer might well be that the actual Java source really does look like that, but that's not what "the original" file is written in, if that makes sense. Like 95% of the project is maintained in straight up Java, but things dealing with different crypto implementations, or features not available in the public release, are sometimes maintained "one level up". Full disclosure: I'm a contractor, not a DoD employee; as the maintainer I can safely speak for what the project was and is. But as to what the project will do in the future, all I can do is give you my best Magic Eight Ball guess. Namely: if it happens, it probably won't be soon. Most of us on the project are big believers in open source but convincing the higher-ups that it would be worth doing that for EW is a looooooooong undertaking. Going open source -- or making any other change to policy, or management, or whatever -- has to help the DoD solve the problems which this software was created to solve. It's not that the entire organization is against the idea of libre software -- AFRL is a research group, they get how good software development works -- it's just that their default position is "make no change" and any other approach has to show a demonstrable, concrete benefit over what they're already getting. In the meantime... well, the EW-Public license specifically allows decompiling, which everybody was going to do anyhow. :-) It's not the same, but it makes looking for vulnerabilities way easier.