8 ms·

Think BinaryNinja has been acting pretty effectively as a competitor to IDA Pro. Its much cheaper than IDA, has a good API and I have been a very happy customer

by dman 8y ago

Think BinaryNinja has been acting pretty effectively as a competitor to IDA Pro. Its much cheaper than IDA, has a good API and I have been a very happy customer.

justinjlynn 8y ago
It's not Open Source.
- idlewords 8y ago
  You can just reverse-engineer it!
  - justinjlynn 8y ago
    No, you almost certainly promised not to do so when you bought a licence.
    - gpm 8y ago
      Ghidra on the other hand you could, since even if they never get around to fully releasing the source (unlikely) they still granted us an apache license on the whole thing :) I think it's probably pretty unique right now in that it's under an OSS license without all the source available.
      - pcwalton 8y ago
        Ghidra is mostly Java, so decompilation would pretty high-fidelity to begin with.
        gpm 8y ago
        The java sources seem to all be there in zip files actually (as far as I can tell). The part I was most interested in atm (the decompiler) turns out to be some sort of native language compiled to an executable, and its source isn't there.
      - MrMorden 8y ago
        All the source is in .zip files in the download. What's missing (and coming soon) is a build system.
    - legitbs_ctf 8y ago
      That’s actually untrue - they explicitly give permission to reverse engineer their software in the license. Check restrictions in https://docs.binary.ninja/about/license/index.html https://docs.binary.ninja/about/license/index.html
      - elliotec 8y ago
        For the lazy: > Restrictions. Subject to applicable copyright, trade secret and other laws, you are permitted under this License to reverse engineer or de-compile the Software but you may not alter, duplicate, modify, rent, lease, loan, sublicense, create derivative works from or provide others with the Software in whole or part, or transmit or communicate any of the Software over a network in order to share it with others.
        justinjlynn 8y ago
        > create derivative works from That's pretty much the only reason one would reverse engineer it, in this context - and it's somewhat misleading to suggest otherwise.
        reitanqild 8y ago
        Hunting for bugs to report would be a valid, wouldn't it?
        justinjlynn 8y ago
        I'd rather just have the damn code.
        vectorEQ 8y ago
        that always of course :D
        BuildTheRobots 8y ago
        Not if you're oracle.
    - deleted 8y ago
      [deleted]
- dman 8y ago
  If you have any pointers to a company / individual making a living building open source tools for developers please let me know. (Working for a large cloud / OS provider that is subsidizing tool development as part of a platform play does not count).
  - kfriede 8y ago
    Redis. Sidekiq.
    - forgingahead 8y ago
      Sidekiq charges for their Enterprise plan which starts at $179 per month, Redis offers paid Commercial Support. The money always comes from somewhere...
      - ascorbic 8y ago
        Open source doesn't mean free.
      - jazzyjackson 8y ago
        Yeah, the question was about getting paid to develop open source software. The answer is, sell support.
        anyzen 8y ago
        Wrong answer. Selling support means that the developer is incentivized to make product unnecessarily complex. Also, with recent developments it turns out that other entities might be better at providing support than original developers, taking away the option to monetize OSS. Why bother writing your own software, when you can just sell services and provide support for a different one? Note that RedHat, often quoted as success story, is really a services company that just happens to write an occasional piece of software, and support them when their customers need it.
        8y ago
- lsiebert 8y ago
  It's being released at RSA as open source, so it's more correct to say that it's not open source yet.
  - EE84M3i 8y ago
    This was in reference to Binary Ninja, which was neither released at RSA nor is Open Source.
- maccio92 8y ago
  not everything in the world has to be open source
  - birdiesanders 8y ago
    True, but we do need one of everything to be open source.
  - deleted 8y ago
    [deleted]
jjoonathan 8y ago
And they didn't take my money, break my key in an update, and ghost me while I was still in the support period. So they've got that going for them.
- philpem 8y ago
  Did they ever tell you why they did that? I'd like to hear the rest of this story, I was considering buying IDA Pro (though these days I'm having a lot of fun adding M68k support to Avast's Retdec)
  - jjoonathan 8y ago
    No, they never replied at all. Their self-service site broke and they completely and utterly ignored my emails to the associated service address and to a number of other addresses posted on their site. I grew up using, ah, other methods of satisfying my need for an interactive debugger and those methods continued to be viable after giving hex-rays $1100 and getting flaked, so I wasn't materially impacted by the flakery, even though I "should" have been. Had I been materially impacted rather than merely angered and frustrated, I probably would have tried other escalation paths -- phone, twitter, maybe even snail mail -- and I suspect I eventually could have gotten through, and my expectation absent evidence to the contrary is that if I were to have gotten through they would have helped me out. My takeaway would be "their self-service site is rubbish and they force you to use a company email address (as opposed to your gmail) and then their support email servers sometimes silently drop messages from your company email address, or something," not "they're crooks." On a professional app sold at a professional price, though, that's still not a good thing, and it informed my software choices going forward.
    - psifertex 8y ago
      This is really strange to hear. What self service site did you use? Our website chat goes right to a slack channel that multiple folks monitor and reply to at all hours of the day. Worst case if we're all sleeping and you leave an email we respond when we're awake. Just searched for your username in our chat and our email and don't see anything so I assume you've got a different email?
nneonneo 8y ago
Being open-sourced is a big advantage. I just fixed a bug in GHIDRA relating to trackpad scrolling which makes it MUCH more usable for me. I could never do the same with IDA or Binary Ninja. I do so love the shell code compiler of Binary Ninja, though. It works very well and has definitely saved me a lot of time.
- AsyncAwait 8y ago
  Awesome! Please don't forget to submit it as a pull request once the code's on GitHub.
  - SEJeff 8y ago
    https://github.com/NationalSecurityAgency/ghidra https://github.com/NationalSecurityAgency/ghidra
  - nneonneo 8y ago
    Of course. In the meantime I posted patched binaries to the relevant issue: https://github.com/NationalSecurityAgency/ghidra/issues/2#issuecomment-469999523 https://github.com/NationalSecurityAgency/ghidra/issues/2#is... As soon as the code is up I hope to submit a PR, which will be pretty easy since I already have the diff.
- pcwalton 8y ago
  Speak of the devil—I was just thinking about diving in to fix that issue. Thank you! :)

by dman 8y ago

Think BinaryNinja has been acting pretty effectively as a competitor to IDA Pro. Its much cheaper than IDA, has a good API and I have been a very happy customer.

justinjlynn 8y ago

It's not Open Source.

idlewords 8y ago
You can just reverse-engineer it!
- justinjlynn 8y ago
  No, you almost certainly promised not to do so when you bought a licence.
  - gpm 8y ago
    Ghidra on the other hand you could, since even if they never get around to fully releasing the source (unlikely) they still granted us an apache license on the whole thing :) I think it's probably pretty unique right now in that it's under an OSS license without all the source available.
    - pcwalton 8y ago
      Ghidra is mostly Java, so decompilation would pretty high-fidelity to begin with.
      - gpm 8y ago
        The java sources seem to all be there in zip files actually (as far as I can tell). The part I was most interested in atm (the decompiler) turns out to be some sort of native language compiled to an executable, and its source isn't there.
    - MrMorden 8y ago
      All the source is in .zip files in the download. What's missing (and coming soon) is a build system.
  - legitbs_ctf 8y ago
    That’s actually untrue - they explicitly give permission to reverse engineer their software in the license. Check restrictions in https://docs.binary.ninja/about/license/index.html https://docs.binary.ninja/about/license/index.html
    - elliotec 8y ago
      For the lazy: > Restrictions. Subject to applicable copyright, trade secret and other laws, you are permitted under this License to reverse engineer or de-compile the Software but you may not alter, duplicate, modify, rent, lease, loan, sublicense, create derivative works from or provide others with the Software in whole or part, or transmit or communicate any of the Software over a network in order to share it with others.
      - justinjlynn 8y ago
        > create derivative works from That's pretty much the only reason one would reverse engineer it, in this context - and it's somewhat misleading to suggest otherwise.
        reitanqild 8y ago
        Hunting for bugs to report would be a valid, wouldn't it?
        justinjlynn 8y ago
        I'd rather just have the damn code.
        vectorEQ 8y ago
        that always of course :D
        BuildTheRobots 8y ago
        Not if you're oracle.
  - deleted 8y ago
    [deleted]
dman 8y ago
If you have any pointers to a company / individual making a living building open source tools for developers please let me know. (Working for a large cloud / OS provider that is subsidizing tool development as part of a platform play does not count).
- kfriede 8y ago
  Redis. Sidekiq.
  - forgingahead 8y ago
    Sidekiq charges for their Enterprise plan which starts at $179 per month, Redis offers paid Commercial Support. The money always comes from somewhere...
    - ascorbic 8y ago
      Open source doesn't mean free.
    - jazzyjackson 8y ago
      Yeah, the question was about getting paid to develop open source software. The answer is, sell support.
      - anyzen 8y ago
        Wrong answer. Selling support means that the developer is incentivized to make product unnecessarily complex. Also, with recent developments it turns out that other entities might be better at providing support than original developers, taking away the option to monetize OSS. Why bother writing your own software, when you can just sell services and provide support for a different one? Note that RedHat, often quoted as success story, is really a services company that just happens to write an occasional piece of software, and support them when their customers need it.
        8y ago
lsiebert 8y ago
It's being released at RSA as open source, so it's more correct to say that it's not open source yet.
- EE84M3i 8y ago
  This was in reference to Binary Ninja, which was neither released at RSA nor is Open Source.
maccio92 8y ago
not everything in the world has to be open source
- birdiesanders 8y ago
  True, but we do need one of everything to be open source.
- deleted 8y ago
  [deleted]

jjoonathan 8y ago

And they didn't take my money, break my key in an update, and ghost me while I was still in the support period. So they've got that going for them.

philpem 8y ago
Did they ever tell you why they did that? I'd like to hear the rest of this story, I was considering buying IDA Pro (though these days I'm having a lot of fun adding M68k support to Avast's Retdec)
- jjoonathan 8y ago
  No, they never replied at all. Their self-service site broke and they completely and utterly ignored my emails to the associated service address and to a number of other addresses posted on their site. I grew up using, ah, other methods of satisfying my need for an interactive debugger and those methods continued to be viable after giving hex-rays $1100 and getting flaked, so I wasn't materially impacted by the flakery, even though I "should" have been. Had I been materially impacted rather than merely angered and frustrated, I probably would have tried other escalation paths -- phone, twitter, maybe even snail mail -- and I suspect I eventually could have gotten through, and my expectation absent evidence to the contrary is that if I were to have gotten through they would have helped me out. My takeaway would be "their self-service site is rubbish and they force you to use a company email address (as opposed to your gmail) and then their support email servers sometimes silently drop messages from your company email address, or something," not "they're crooks." On a professional app sold at a professional price, though, that's still not a good thing, and it informed my software choices going forward.
  - psifertex 8y ago
    This is really strange to hear. What self service site did you use? Our website chat goes right to a slack channel that multiple folks monitor and reply to at all hours of the day. Worst case if we're all sleeping and you leave an email we respond when we're awake. Just searched for your username in our chat and our email and don't see anything so I assume you've got a different email?

nneonneo 8y ago

Being open-sourced is a big advantage. I just fixed a bug in GHIDRA relating to trackpad scrolling which makes it MUCH more usable for me. I could never do the same with IDA or Binary Ninja. I do so love the shell code compiler of Binary Ninja, though. It works very well and has definitely saved me a lot of time.

AsyncAwait 8y ago
Awesome! Please don't forget to submit it as a pull request once the code's on GitHub.
- SEJeff 8y ago
  https://github.com/NationalSecurityAgency/ghidra https://github.com/NationalSecurityAgency/ghidra
- nneonneo 8y ago
  Of course. In the meantime I posted patched binaries to the relevant issue: https://github.com/NationalSecurityAgency/ghidra/issues/2#issuecomment-469999523 https://github.com/NationalSecurityAgency/ghidra/issues/2#is... As soon as the code is up I hope to submit a PR, which will be pretty easy since I already have the diff.
pcwalton 8y ago
Speak of the devil—I was just thinking about diving in to fix that issue. Thank you! :)