5 ms·

I've been a customer since ~2010, and have been paying out of my personal pocket the $469 / year support renewal for a standard IDA Pro named license, which I'v

I've been a customer since ~2010, and have been paying out of my personal pocket the $469 / year support renewal for a standard IDA Pro named license, which I've carried with me through various jobs in my career. The new subscription model will almost double my costs ($900 / year), all while I've been getting less and less value with each update. Furthermore if I ever stop paying, I will lose access to the product. Whereas if I stop paying now, I will maintain indefinite access to what I currently have. I think I simply won't renew next year, and will rely on Ghidra to fill any gaps going forward.

teakettle42 5y ago
This is going to increase my costs from $4800/year to $8000/year, and yeah, no more perpetual license. I’ve been paying for Hex-Rays out of my own pocket for a decade because it’s a great tool, but $8000/year for a personal license subscription? Forget it.
masklinn 5y ago
> Furthermore if I ever stop paying, I will lose access to the product. Wow, not even a perpetual fallback license? I wasn't super thrilled when Jetbrains switched to a more subscription-based system, but being grandfathered in (so I didn't have to restart the subscriptions as if I were a new client), the heaps of existing goodwill they'd built up, made the changeover much less of an issue, and super importantly finally listening to customer and adding perpetual fallback licenses alleviated much of the fear.
- noasaservice 5y ago
  As an aside, "grandfathered in" is a historically terrible term. The term you're looking for is a "legacy license". It's not terribly well known just how terrible this phrase actually is. I ran across it myself probably a few months back. > "If all these white people are going to be noncitizens along with blacks, the idea is going to lose a lot of support," says James Smethurst, who teaches African-American studies at the University of Massachusetts. The solution? A half-dozen states passed laws that made men eligible to vote if they had been able to vote before African-Americans were given the franchise (generally, 1867), or if they were the lineal descendants of voters back then. This was called the grandfather clause. Most such laws were enacted in the early 1890s. https://www.npr.org/sections/codeswitch/2013/10/21/239081586/the-racial-history-of-the-grandfather-clause https://www.npr.org/sections/codeswitch/2013/10/21/239081586...
  - exolymph 5y ago
    But if virtually nobody who uses the term knows that "grandfathered in" has an unsavory past, does it really cause much harm to use that phrase?
    - deleted 5y ago
      [deleted]
    - drekk 5y ago
      Does virtually nobody know? I haven't met a black American yet who didn't. Perhaps a better question: if you know a term has a racist history, why are you so attached to the specific term?
  - johnhowardstein 5y ago
    NO! Speak English like how I want you to! Do you know how you sound?
  - lazysheepherd 5y ago
    I could not have guessed for a million years that this pharse could have had such a meaning. These vanity-soaked strokes of needless sensitivity is precisely what is keeping these bad meanings alive. No one knows, or remembers an association, yet you can't help yourself doing a great disservice to the cause you pretend to care, by popping up and unsolicitedly "correcting" someone. https://youtu.be/GeixtYS-P3s https://youtu.be/GeixtYS-P3s
    - heavyset_go 5y ago
      This sounds like you're celebrating ignorance. There's nothing bad or wrong about learning facts and truths about the world we live in, and that includes learning about history and etymology.
      - lazysheepherd 5y ago
        Sorry, it has nothing to do with etymology. It is a remote and obscure use case which may or may not be offensive to some group or other. I do not care. I'm here to read about some tech company changing their revenue model, and what tech people has to say about it. If I cared about endless discussions and virtual virtue hoarding about race, gender and politics, I'd be browsing the dark side of twitter, not the front page of HN. I'm so tired of langauge being turned into a minefield, and every conversation ending up being about race, gender, religion, politics and whatnot. I'm a technical person, I care about technical stuff, and I use langauge to communicate technical ideas, not ideological ones.
TkTech 5y ago
I'm in the same boat. It's finally passed the point where I'd rather spend a few slow weekends adding missing QoL features to Ghidra then renew IDA.
ljhsiung 5y ago
I'm a big fan of the radare2 suite. The integration of its ecosystem/plugin support is phenomenal. Only the decompiler is better in Ghidra, IMO, but I'm sure there's a plugin for that.
- ShrigmaMale 5y ago
  There is. Rizin also has some interesting improvements (like mew save by serialization of state instead if command sequence) which is nice since it initially looked like a CoC fork.
  - xvilka 5y ago
    For integration with Ghidra decompiler there's rz-ghidra[1]. It is also bundled in the Cutter[2] releases[3]. [1] https://github.com/rizinorg/rz-ghidra https://github.com/rizinorg/rz-ghidra [2] https://cutter.re https://cutter.re [3] https://github.com/rizinorg/cutter/releases https://github.com/rizinorg/cutter/releases
ShrigmaMale 5y ago
The real reason for many subscription models is to juice more revenue from users, charging over time allows for a higher price with less sticker shock.
- vmception 5y ago
  There was once set of Christmas themed console controllers (one Red, one Green) with the model name "Profit Driver" For whatever reason at the time, that opened my mind to why people do things
- errantspark 5y ago
  The real reason for the software as a service model is that it makes it easier to extract/capture value. Many SaaS offerings would be better at providing value to customers with non-SaaS architectures, unfortunately providing value to customers is second to providing value to shareholders. Don't pay for SaaS, don't encourage this bullshit. If foss offerings don't cover your usecase piracy is better for humanity than paying.
  - echelon 5y ago
    So don't pay the engineers that built the product and continue to maintain it? That's fine with fixed priced software if the software is static and frozen in time, but most software is living and breathing and requires continual investment. You can absolutely use an old WordStar license. In fact, several notable authors do.
    - errantspark 5y ago
      > So don't pay the engineers that built the product and continue to maintain it? Saas isn't the only way to pay people. > most software is living and breathing and requires continual investment Is it though? or is this broadly another side effect of value extraction focused engineering? I'm quite happy to buy a new version if it makes my life notably easier. CS2 is broadly a better experience than CC, etc. etc.
jdefr89 5y ago
BinaryNinja... Switch to that.
squid_demon 5y ago
Just make sure you get the latest Ghidra update with the log4j issue addressed :)
- shagie 5y ago
  ... and readdressed. https://logging.apache.org/log4j/2.x/security.html https://logging.apache.org/log4j/2.x/security.html > It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in a denial of service (DOS) attack. Log4j 2.15.0 restricts JNDI LDAP lookups to localhost by default. Note that previous mitigations involving configuration such as to set the system property log4j2.noFormatMsgLookup to true do NOT mitigate this specific vulnerability.

teakettle42 5y ago

This is going to increase my costs from $4800/year to $8000/year, and yeah, no more perpetual license. I’ve been paying for Hex-Rays out of my own pocket for a decade because it’s a great tool, but $8000/year for a personal license subscription? Forget it.

masklinn 5y ago

> Furthermore if I ever stop paying, I will lose access to the product. Wow, not even a perpetual fallback license? I wasn't super thrilled when Jetbrains switched to a more subscription-based system, but being grandfathered in (so I didn't have to restart the subscriptions as if I were a new client), the heaps of existing goodwill they'd built up, made the changeover much less of an issue, and super importantly finally listening to customer and adding perpetual fallback licenses alleviated much of the fear.

noasaservice 5y ago
As an aside, "grandfathered in" is a historically terrible term. The term you're looking for is a "legacy license". It's not terribly well known just how terrible this phrase actually is. I ran across it myself probably a few months back. > "If all these white people are going to be noncitizens along with blacks, the idea is going to lose a lot of support," says James Smethurst, who teaches African-American studies at the University of Massachusetts. The solution? A half-dozen states passed laws that made men eligible to vote if they had been able to vote before African-Americans were given the franchise (generally, 1867), or if they were the lineal descendants of voters back then. This was called the grandfather clause. Most such laws were enacted in the early 1890s. https://www.npr.org/sections/codeswitch/2013/10/21/239081586/the-racial-history-of-the-grandfather-clause https://www.npr.org/sections/codeswitch/2013/10/21/239081586...
- exolymph 5y ago
  But if virtually nobody who uses the term knows that "grandfathered in" has an unsavory past, does it really cause much harm to use that phrase?
  - deleted 5y ago
    [deleted]
  - drekk 5y ago
    Does virtually nobody know? I haven't met a black American yet who didn't. Perhaps a better question: if you know a term has a racist history, why are you so attached to the specific term?
- johnhowardstein 5y ago
  NO! Speak English like how I want you to! Do you know how you sound?
- lazysheepherd 5y ago
  I could not have guessed for a million years that this pharse could have had such a meaning. These vanity-soaked strokes of needless sensitivity is precisely what is keeping these bad meanings alive. No one knows, or remembers an association, yet you can't help yourself doing a great disservice to the cause you pretend to care, by popping up and unsolicitedly "correcting" someone. https://youtu.be/GeixtYS-P3s https://youtu.be/GeixtYS-P3s
  - heavyset_go 5y ago
    This sounds like you're celebrating ignorance. There's nothing bad or wrong about learning facts and truths about the world we live in, and that includes learning about history and etymology.
    - lazysheepherd 5y ago
      Sorry, it has nothing to do with etymology. It is a remote and obscure use case which may or may not be offensive to some group or other. I do not care. I'm here to read about some tech company changing their revenue model, and what tech people has to say about it. If I cared about endless discussions and virtual virtue hoarding about race, gender and politics, I'd be browsing the dark side of twitter, not the front page of HN. I'm so tired of langauge being turned into a minefield, and every conversation ending up being about race, gender, religion, politics and whatnot. I'm a technical person, I care about technical stuff, and I use langauge to communicate technical ideas, not ideological ones.

TkTech 5y ago

I'm in the same boat. It's finally passed the point where I'd rather spend a few slow weekends adding missing QoL features to Ghidra then renew IDA.

ljhsiung 5y ago

I'm a big fan of the radare2 suite. The integration of its ecosystem/plugin support is phenomenal. Only the decompiler is better in Ghidra, IMO, but I'm sure there's a plugin for that.

ShrigmaMale 5y ago
There is. Rizin also has some interesting improvements (like mew save by serialization of state instead if command sequence) which is nice since it initially looked like a CoC fork.
- xvilka 5y ago
  For integration with Ghidra decompiler there's rz-ghidra[1]. It is also bundled in the Cutter[2] releases[3]. [1] https://github.com/rizinorg/rz-ghidra https://github.com/rizinorg/rz-ghidra [2] https://cutter.re https://cutter.re [3] https://github.com/rizinorg/cutter/releases https://github.com/rizinorg/cutter/releases

ShrigmaMale 5y ago

The real reason for many subscription models is to juice more revenue from users, charging over time allows for a higher price with less sticker shock.

vmception 5y ago
There was once set of Christmas themed console controllers (one Red, one Green) with the model name "Profit Driver" For whatever reason at the time, that opened my mind to why people do things
errantspark 5y ago
The real reason for the software as a service model is that it makes it easier to extract/capture value. Many SaaS offerings would be better at providing value to customers with non-SaaS architectures, unfortunately providing value to customers is second to providing value to shareholders. Don't pay for SaaS, don't encourage this bullshit. If foss offerings don't cover your usecase piracy is better for humanity than paying.
- echelon 5y ago
  So don't pay the engineers that built the product and continue to maintain it? That's fine with fixed priced software if the software is static and frozen in time, but most software is living and breathing and requires continual investment. You can absolutely use an old WordStar license. In fact, several notable authors do.
  - errantspark 5y ago
    > So don't pay the engineers that built the product and continue to maintain it? Saas isn't the only way to pay people. > most software is living and breathing and requires continual investment Is it though? or is this broadly another side effect of value extraction focused engineering? I'm quite happy to buy a new version if it makes my life notably easier. CS2 is broadly a better experience than CC, etc. etc.

jdefr89 5y ago

BinaryNinja... Switch to that.

squid_demon 5y ago

Just make sure you get the latest Ghidra update with the log4j issue addressed :)

shagie 5y ago
... and readdressed. https://logging.apache.org/log4j/2.x/security.html https://logging.apache.org/log4j/2.x/security.html > It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in a denial of service (DOS) attack. Log4j 2.15.0 restricts JNDI LDAP lookups to localhost by default. Note that previous mitigations involving configuration such as to set the system property log4j2.noFormatMsgLookup to true do NOT mitigate this specific vulnerability.