5 ms·

As alternative tools like Ghidra or even some of the cheaper options like Hopper become more popular, I suspect Hex-Rays recognizes that corporate licenses are

As alternative tools like Ghidra or even some of the cheaper options like Hopper become more popular, I suspect Hex-Rays recognizes that corporate licenses are their bread and butter. From a business perspective it makes sense to squeeze as much out of these companies as they can get away with. The subscription costs are only a fraction of an annual salary. Unfortunately this leaves the hobbyist and individuals behind. ~$1K/year isn't out of the realm of what I pay for other tools, but it's really hard to justify it when I can open Ghidra and get 95% of the way there without the subscription model. IDA really is great for handling edge cases and obscure architectures, but I hope this last switch-up by Hex-Rays pushes even more developer attention toward improving the open-source alternatives.

nekitamo 5y ago
By squeezing out hobbyists and individuals, they're shooting themselves in the foot over the long term. The only reason any corporation I worked for purchased IDA Pro licenses was because I recommended it. The only reason I recommended it is because I could (barely) afford a personal license, and play with it in my own time. Going forward they're going to miss out on this word-of-mouth marketing, which I expect will negatively affect sales expansion going forward.
- ohazi 5y ago
  They should probably supplement this "expensive corporate SaaS pricing" model with a "free for personal use" option if they want to have any hope of maintaining their standing.
  - wila 5y ago
    You mean like this? https://hex-rays.com/ida-free/ https://hex-rays.com/ida-free/
    - anonymousiam 5y ago
      Not sure if they've changed things because I haven't bought a product from them for almost 10 years, but back then the free option was several releases behind the current offering, and lacking many features. Also, back then there was NO free version of HexRays (a separate product).
      - bri3d 5y ago
        As of May of this year, IDA Free is a lot less broken now, so they are making some progress. It's no longer ancient and it has the same "cloud based" Hex-Rays that the Home version does, albeit only for x64.
        spijdar 5y ago
        Home also only comes with the x64 "cloud" decompiler, at least if you buy the x86 version. Having paid for a home license last year (mostly for the ability to run Python scripts) and discovering the home version has a sabotaged python implementation (can only run scripts individually from the GUI instead of running them from the command line, and you don't get the toolkit to develop scripts/plugins), it seems kind of hilarious that the free version is so close in feature set to Home. What's the difference even? They're both for "non-commercial use only", is the (limited) python script interface the only reason to pay $365 a year now? That, Lumina, and email support?
        bri3d 5y ago
        I mean - script support is a big deal for a lot of use cases. I think the other big thing is that unlike Free, you can buy Home for other architectures (although only some and not all other architectures, another incredible mystery). I'd buy Home if it came in C167, not because I want to but because $365/year is still a lot less time than I'd spend writing/finishing a C167 module for Ghidra. Anyway, the pricing model doesn't actually make any sense no matter how you slice it, and this latest announcement is even more bizarre. I really wonder how long for this world Hex-Rays products are, the always glacial development pace is still quite slow and as a new generation of people start by using Ghidra, there will IMO be less drive to buy corporate IDA renewals going forward.
    - FineTralfazz 5y ago
      Maybe it's improved since, but last time I used IDA free the cloud decompiler was buggy and weird and it was overall a mediocre experience. I don't see why anyone would choose to use it instead of Ghidra unless they were explicitly trying to learn IDA because it's the industry standard, and I don't see it holding that position long-term unless they improve their free/cheap offerings.
- TOMDM 5y ago
  They only lose out in the long term by doing this if you believe they can compete in the long term. If you're an exec at Hex-rays and you believe that Ghidra will eventually out compete you, then it makes sense to squeeze every penny you can before you're irrelevant.
  - saagarjha 5y ago
    Does Hex Rays have an exec team? I thought it was just Ilfak and a couple others.
- hunter-gatherer 5y ago
  My shop cancelled our IDA licenses last year and forced us all to use Ghidra. The struggle lasted like 2 days. We have all been wildly impressed with Ghidra.
jjoonathan 5y ago
Long ago, when I got my first paycheck, I "went legit" and bought licenses for TextMate, Sublime, and IDA. Long story short, HexRays took my $1000 and never gave me a working version of their software. Bastards. I'm so glad there is an alternative now. To this very day, whenever I'm stuck slogging through the build or debug process of a Ghidra plugin that has a more mature alternative in the IDA universe, I occasionally let a tiny bit of that resentment bubble to the surface to propel me across the finish line.
- rene77 5y ago
  Shenanigans like that the product owe to its author, Ilfak Guilfanov, who's a bit of a meme in the ex-USSR SRE community. Back in the '00s, when IDA pretty much had no alternative, one couldn't just buy it. No, to pay them money, you had to be either an estabilished name (ESET or Kaspersky worked just fine), or to subtly caress the author's ego until it gives. And I've seen paying customers being kicked off the support forum for asking uncomfortable questions, complete with rude private messages. I believe that at least twice, unrelated hackers took offense and leaked the full version anyway. Fun times.
  - pelagicAustral 5y ago
    Haha yes. I remember that NFO like very few, perhaps m00 nfos but that’s it. The leaked IDA pro was fenomenal, can’t think of the group name to see if I can find it around. I’ll make an effort.
  - jjoonathan 5y ago
    Yeah, B2B is a wild world and this was my first time going for a ride. Ah well. You live you learn. Speaking of which, last time this came up on HN ilfak cruised into the comments a week later, all "I can not find your nickname in our database," and I didn't see the reply until a year later. Well, the HexRays database had no problem finding my-nickname-at-gmail for the purposes of bugging me to renew, and just in case anyone thinks I'm making this up, here's the order. I also have an email with the download link and serial number -- the ones that didn't work -- and the ghosted support requests spread throughout the following year. I'm sure this is a Hanlon's Razor thing, I just want to make sure that any naive young hackers considering the possibility of a last-time-buy on a perpetual license understand what they are getting into. ************************************************************ * Your order has been accepted. ************************************************************ Please retain this receipt for your records. This e-mail confirms your order placed with Hex-Rays. Payment data ------------ Beneficiary : Hex-Rays Address : Rue Rennequin Sualem 34 BE-4000 Liege Website address : http://www.hex-rays.com General conditions : https://www.hex-rays.com/products/ida/t&c.pdf Order date : 15/05/2016 22:40:05 Order reference : deWerd_4732_20160515 Ogone Payment reference : 3016168801 Order description : IDA license Total : 1129.00 USD Charging method : MasterCard XXXXXXXXXXXX---- Sub-brand : UNDEFINED Status : Authorised Authorisation code : ------
saagarjha 5y ago
> IDA really is great for handling edge cases and obscure architecture I find Ghidra to be much better at this, since people actually write loafers for it and you get a decompiler “for free”.
- bri3d 5y ago
  Agreed. I find IDA to be much better than Ghidra for common things: Windows C++ or Delphi applications and ARM Objective-C where the heuristic guided decompiler really shines and Ghidra gets lost easily. For the obscure architectures Ghidra does support, it's way better than IDA by virtue of having a decompiler alone. Even if the decompilation is subtly wrong, the broad strokes are so much easier to navigate that finding the right method to go through by hand is much easier. And once you dive into Ghidra's P-Code IR and more advanced plugin support and move beyond existing IDA plugins, it's honestly better than IDA for things nobody has done before. Now, there are some obscure architectures like C167 for which we still lack a working Ghidra processor model, but this is only a matter of time - and once it comes, it will already be way ahead of IDA!
  - psifertex 5y ago
    If automation and analysis over the IR is your goal, Binary Ninja is the far better choice compared to both Ghidra and IDA. There's always things to work on but even most people who don't use Binary Ninja regularly who have evaluated it agree that our API/BNIL stack is superior to other options. Disclaimer: BN founder, so biased of course but I'm pretty up-front about our strengths/weaknesses.
    - bri3d 5y ago
      As I mainly reverse automative hardware, I care about only Tricore, C167, SuperH, and PowerPC, in that order - which means Binary Ninja is out for me for the time being! Thanks for the post though, as I did look into adding a new Architecture and the setup for defining a new ISA is much simpler than it is in even Ghidra/SLEIGH, so kudos to that. Maybe if I find myself with a lot of free time I will try adding something.
anonymousisme 5y ago
Ghidra has been publicly available for less than half the time of IDA/HexRays, but it has really caught up fast. https://reverseengineering.stackexchange.com/questions/22676/cpu-support-by-ghidra https://reverseengineering.stackexchange.com/questions/22676...
deleted 5y ago
[deleted]
ivanmontillam 5y ago
I've seen IT Security vendors do this as well, in the space of vulnerability scanners specifically. There's this new trend that big players (vendors with the size enough to appear in Gartner), that are investing heavily in bridging the gap between them and the end user, at the expense of the small players (independent IT Security consultants and boutique firms). Their new SaaS offerings are marketed as next generation, while making it seem that their previous product is just legacy and no longer recommended. However, it's the legacy product what got them the growth to be there today. Their On-Prem offering is still for sale, but at a cost very hard to justify. Almost no small player can afford such a cost. I understand the business rationale behind a product management decision like this. But not because it was the right decision at the moment, automatically I have to feel great about it.

nekitamo 5y ago

By squeezing out hobbyists and individuals, they're shooting themselves in the foot over the long term. The only reason any corporation I worked for purchased IDA Pro licenses was because I recommended it. The only reason I recommended it is because I could (barely) afford a personal license, and play with it in my own time. Going forward they're going to miss out on this word-of-mouth marketing, which I expect will negatively affect sales expansion going forward.

ohazi 5y ago
They should probably supplement this "expensive corporate SaaS pricing" model with a "free for personal use" option if they want to have any hope of maintaining their standing.
- wila 5y ago
  You mean like this? https://hex-rays.com/ida-free/ https://hex-rays.com/ida-free/
  - anonymousiam 5y ago
    Not sure if they've changed things because I haven't bought a product from them for almost 10 years, but back then the free option was several releases behind the current offering, and lacking many features. Also, back then there was NO free version of HexRays (a separate product).
    - bri3d 5y ago
      As of May of this year, IDA Free is a lot less broken now, so they are making some progress. It's no longer ancient and it has the same "cloud based" Hex-Rays that the Home version does, albeit only for x64.
      - spijdar 5y ago
        Home also only comes with the x64 "cloud" decompiler, at least if you buy the x86 version. Having paid for a home license last year (mostly for the ability to run Python scripts) and discovering the home version has a sabotaged python implementation (can only run scripts individually from the GUI instead of running them from the command line, and you don't get the toolkit to develop scripts/plugins), it seems kind of hilarious that the free version is so close in feature set to Home. What's the difference even? They're both for "non-commercial use only", is the (limited) python script interface the only reason to pay $365 a year now? That, Lumina, and email support?
        bri3d 5y ago
        I mean - script support is a big deal for a lot of use cases. I think the other big thing is that unlike Free, you can buy Home for other architectures (although only some and not all other architectures, another incredible mystery). I'd buy Home if it came in C167, not because I want to but because $365/year is still a lot less time than I'd spend writing/finishing a C167 module for Ghidra. Anyway, the pricing model doesn't actually make any sense no matter how you slice it, and this latest announcement is even more bizarre. I really wonder how long for this world Hex-Rays products are, the always glacial development pace is still quite slow and as a new generation of people start by using Ghidra, there will IMO be less drive to buy corporate IDA renewals going forward.
  - FineTralfazz 5y ago
    Maybe it's improved since, but last time I used IDA free the cloud decompiler was buggy and weird and it was overall a mediocre experience. I don't see why anyone would choose to use it instead of Ghidra unless they were explicitly trying to learn IDA because it's the industry standard, and I don't see it holding that position long-term unless they improve their free/cheap offerings.
TOMDM 5y ago
They only lose out in the long term by doing this if you believe they can compete in the long term. If you're an exec at Hex-rays and you believe that Ghidra will eventually out compete you, then it makes sense to squeeze every penny you can before you're irrelevant.
- saagarjha 5y ago
  Does Hex Rays have an exec team? I thought it was just Ilfak and a couple others.
hunter-gatherer 5y ago
My shop cancelled our IDA licenses last year and forced us all to use Ghidra. The struggle lasted like 2 days. We have all been wildly impressed with Ghidra.

jjoonathan 5y ago

Long ago, when I got my first paycheck, I "went legit" and bought licenses for TextMate, Sublime, and IDA. Long story short, HexRays took my $1000 and never gave me a working version of their software. Bastards. I'm so glad there is an alternative now. To this very day, whenever I'm stuck slogging through the build or debug process of a Ghidra plugin that has a more mature alternative in the IDA universe, I occasionally let a tiny bit of that resentment bubble to the surface to propel me across the finish line.

rene77 5y ago
Shenanigans like that the product owe to its author, Ilfak Guilfanov, who's a bit of a meme in the ex-USSR SRE community. Back in the '00s, when IDA pretty much had no alternative, one couldn't just buy it. No, to pay them money, you had to be either an estabilished name (ESET or Kaspersky worked just fine), or to subtly caress the author's ego until it gives. And I've seen paying customers being kicked off the support forum for asking uncomfortable questions, complete with rude private messages. I believe that at least twice, unrelated hackers took offense and leaked the full version anyway. Fun times.
- pelagicAustral 5y ago
  Haha yes. I remember that NFO like very few, perhaps m00 nfos but that’s it. The leaked IDA pro was fenomenal, can’t think of the group name to see if I can find it around. I’ll make an effort.
- jjoonathan 5y ago
  Yeah, B2B is a wild world and this was my first time going for a ride. Ah well. You live you learn. Speaking of which, last time this came up on HN ilfak cruised into the comments a week later, all "I can not find your nickname in our database," and I didn't see the reply until a year later. Well, the HexRays database had no problem finding my-nickname-at-gmail for the purposes of bugging me to renew, and just in case anyone thinks I'm making this up, here's the order. I also have an email with the download link and serial number -- the ones that didn't work -- and the ghosted support requests spread throughout the following year. I'm sure this is a Hanlon's Razor thing, I just want to make sure that any naive young hackers considering the possibility of a last-time-buy on a perpetual license understand what they are getting into. ************************************************************ * Your order has been accepted. ************************************************************ Please retain this receipt for your records. This e-mail confirms your order placed with Hex-Rays. Payment data ------------ Beneficiary : Hex-Rays Address : Rue Rennequin Sualem 34 BE-4000 Liege Website address : http://www.hex-rays.com General conditions : https://www.hex-rays.com/products/ida/t&c.pdf Order date : 15/05/2016 22:40:05 Order reference : deWerd_4732_20160515 Ogone Payment reference : 3016168801 Order description : IDA license Total : 1129.00 USD Charging method : MasterCard XXXXXXXXXXXX---- Sub-brand : UNDEFINED Status : Authorised Authorisation code : ------

saagarjha 5y ago

> IDA really is great for handling edge cases and obscure architecture I find Ghidra to be much better at this, since people actually write loafers for it and you get a decompiler “for free”.

bri3d 5y ago
Agreed. I find IDA to be much better than Ghidra for common things: Windows C++ or Delphi applications and ARM Objective-C where the heuristic guided decompiler really shines and Ghidra gets lost easily. For the obscure architectures Ghidra does support, it's way better than IDA by virtue of having a decompiler alone. Even if the decompilation is subtly wrong, the broad strokes are so much easier to navigate that finding the right method to go through by hand is much easier. And once you dive into Ghidra's P-Code IR and more advanced plugin support and move beyond existing IDA plugins, it's honestly better than IDA for things nobody has done before. Now, there are some obscure architectures like C167 for which we still lack a working Ghidra processor model, but this is only a matter of time - and once it comes, it will already be way ahead of IDA!
- psifertex 5y ago
  If automation and analysis over the IR is your goal, Binary Ninja is the far better choice compared to both Ghidra and IDA. There's always things to work on but even most people who don't use Binary Ninja regularly who have evaluated it agree that our API/BNIL stack is superior to other options. Disclaimer: BN founder, so biased of course but I'm pretty up-front about our strengths/weaknesses.
  - bri3d 5y ago
    As I mainly reverse automative hardware, I care about only Tricore, C167, SuperH, and PowerPC, in that order - which means Binary Ninja is out for me for the time being! Thanks for the post though, as I did look into adding a new Architecture and the setup for defining a new ISA is much simpler than it is in even Ghidra/SLEIGH, so kudos to that. Maybe if I find myself with a lot of free time I will try adding something.

anonymousisme 5y ago

Ghidra has been publicly available for less than half the time of IDA/HexRays, but it has really caught up fast. https://reverseengineering.stackexchange.com/questions/22676/cpu-support-by-ghidra https://reverseengineering.stackexchange.com/questions/22676...

deleted 5y ago

[deleted]

ivanmontillam 5y ago

I've seen IT Security vendors do this as well, in the space of vulnerability scanners specifically. There's this new trend that big players (vendors with the size enough to appear in Gartner), that are investing heavily in bridging the gap between them and the end user, at the expense of the small players (independent IT Security consultants and boutique firms). Their new SaaS offerings are marketed as next generation, while making it seem that their previous product is just legacy and no longer recommended. However, it's the legacy product what got them the growth to be there today. Their On-Prem offering is still for sale, but at a cost very hard to justify. Almost no small player can afford such a cost. I understand the business rationale behind a product management decision like this. But not because it was the right decision at the moment, automatically I have to feel great about it.