4 ms·

That's ~5 commits a DAY on average since the last release a year ago, primarily from 29 contributors. That is a rate of development that bests most paid teams

That's ~5 commits a DAY on average since the last release a year ago, primarily from 29 contributors. That is a rate of development that bests most paid teams that I know of. I am very impressed. How do you manage so much commitment for an open source project?

spiderfarmer 6y ago
Non ethical hackers can get paid non ethically.
- ccmcarey 6y ago
  Maybe don't make unsubstantiated claims without evidence.
  - 867-5309 6y ago
    it may be suggestive, but it's still a fact
    - _tk_ 6y ago
      How can something be 'suggestive' and 'a fact' at the same time?
      - wongarsu 6y ago
        By being true, and suggesting something else. Obviously non ethical hackers can get paid non ethically. Anyone can get paid non-ethically after all. It's a fact that's so trivial it's useless if you just take it for its factual content. What makes it interesting is the implication that people use hashcat for unethical (and/or illegal) activities and use the proceeds from that to pay for their time improving hashcat. The comment doesn't state that, but it's what we are all thinking when reading it.
    - s0ss 6y ago
      Prove it
    - Dylan16807 6y ago
      The bare fact is not an answer to the question. It's a non sequitur. The clear implication that actually answers the question, that these non ethical hackers are responsible for the commitment to the project, is an unsubstantiated claim.
    - simsla 6y ago
      A fact used to imply completely unsubstantiated facts.
sktrdie 6y ago
When passion drives your work rather than money.
Cthulhu_ 6y ago
Security researchers / developers are employed by companies and organizations that have an interest in this technology, e.g. law enforcement, secret services. I suspect most serious / active open source projects have a number of paid for developers like that. TBH, they need it, if their scale is beyond a small library / utility.
- derefr 6y ago
  hashcat is also one of those tools that is both 1. a “core” that can be used in other software; while also being 2. in a class of software that benefits heavily from network effects (i.e. when someone contributes new algorithms to it, everyone gets just a little further in cracking the “mystery hashes” they have laying about.) Hash reversing as a problem having property #2, virtually guarantees that the landscape of hash-reversing software would look like an oligopoly, because people would use the tools with the most algorithms, and so contribute to those, and so “the rich get richer.” But hashcat having property #1 means that there’s no political reason (e.g. your enterprise wanting to ship something with your own branded GUI on it) to be unable to use hashcat, and so no reason for anyone to create their own new full-stack hash reversing system, when hashcat already exists to be used within such software. Effectively, these properties are the same thing that made ffmpeg the “winner” in its own space, as discussed yesterday (https://news.ycombinator.com/item?id=23540704 https://news.ycombinator.com/item?id=23540704).
- gcbw3 6y ago
  NSA also have lots grants that result in professors bullying their students to contribute to projects like these. The reason this is MIT and not GPL makes this project all sorts of bad. MIT has its places and I have several personal open projects under it, but I can't imagine a case where society would be better by a company having closed hash cracks built on top of open source work.
nine_k 6y ago
A key to merging many commits (PRs, CLs, etc) is in making small commits. It's not just parceling the same amount of work into more pieces. Code review time grows very super-linearly with the amount of code to review.

spiderfarmer 6y ago

Non ethical hackers can get paid non ethically.

ccmcarey 6y ago
Maybe don't make unsubstantiated claims without evidence.
- 867-5309 6y ago
  it may be suggestive, but it's still a fact
  - _tk_ 6y ago
    How can something be 'suggestive' and 'a fact' at the same time?
    - wongarsu 6y ago
      By being true, and suggesting something else. Obviously non ethical hackers can get paid non ethically. Anyone can get paid non-ethically after all. It's a fact that's so trivial it's useless if you just take it for its factual content. What makes it interesting is the implication that people use hashcat for unethical (and/or illegal) activities and use the proceeds from that to pay for their time improving hashcat. The comment doesn't state that, but it's what we are all thinking when reading it.
  - s0ss 6y ago
    Prove it
  - Dylan16807 6y ago
    The bare fact is not an answer to the question. It's a non sequitur. The clear implication that actually answers the question, that these non ethical hackers are responsible for the commitment to the project, is an unsubstantiated claim.
  - simsla 6y ago
    A fact used to imply completely unsubstantiated facts.

sktrdie 6y ago

When passion drives your work rather than money.

Cthulhu_ 6y ago

Security researchers / developers are employed by companies and organizations that have an interest in this technology, e.g. law enforcement, secret services. I suspect most serious / active open source projects have a number of paid for developers like that. TBH, they need it, if their scale is beyond a small library / utility.

derefr 6y ago
hashcat is also one of those tools that is both 1. a “core” that can be used in other software; while also being 2. in a class of software that benefits heavily from network effects (i.e. when someone contributes new algorithms to it, everyone gets just a little further in cracking the “mystery hashes” they have laying about.) Hash reversing as a problem having property #2, virtually guarantees that the landscape of hash-reversing software would look like an oligopoly, because people would use the tools with the most algorithms, and so contribute to those, and so “the rich get richer.” But hashcat having property #1 means that there’s no political reason (e.g. your enterprise wanting to ship something with your own branded GUI on it) to be unable to use hashcat, and so no reason for anyone to create their own new full-stack hash reversing system, when hashcat already exists to be used within such software. Effectively, these properties are the same thing that made ffmpeg the “winner” in its own space, as discussed yesterday (https://news.ycombinator.com/item?id=23540704 https://news.ycombinator.com/item?id=23540704).
gcbw3 6y ago
NSA also have lots grants that result in professors bullying their students to contribute to projects like these. The reason this is MIT and not GPL makes this project all sorts of bad. MIT has its places and I have several personal open projects under it, but I can't imagine a case where society would be better by a company having closed hash cracks built on top of open source work.

nine_k 6y ago

A key to merging many commits (PRs, CLs, etc) is in making small commits. It's not just parceling the same amount of work into more pieces. Code review time grows very super-linearly with the amount of code to review.