7 ms·

This is likely NSA’s most popular repository on GitHub, but worth checking out their others too: - https://github.com/NationalSecurityAgency https://github.com

This is likely NSA’s most popular repository on GitHub, but worth checking out their others too: - https://github.com/NationalSecurityAgency https://github.com/NationalSecurityAgency Prior HN coverage is here: - https://hn.algolia.com/?q=https%3A%2F%2Fgithub.com%2FNationalSecurityAgency https://hn.algolia.com/?q=https%3A%2F%2Fgithub.com%2FNationa... I would be curious if anyone knows what their filter, reasoning, etc - for open sourcing X vs Y. In case of Ghidra, think its existence was originally revealed to the public via WikiLeaks in 2017; might be wrong, but think the software was posted too — for sure though was open sourced two years later in 2019.

beauHD 4y ago
> I would be curious if anyone knows what their filter, reasoning, etc - for open sourcing X vs Y. NSA is both red team and blue team. This is a blue team tool used by reverse engineers to analyze malware, so it was NSA's little gift to researchers, an agency known for hoarding secrets for our 'security'.
- jasonladuke0311 4y ago
  > This is a blue team tool used by reverse engineers to analyze malware It's also a red team tool for binary exploitation. EDIT: The cynic in me posits it was used far more for exploit development than for analyzing malware, unless that had offensive applications too. But I don't know anything, I never worked there.
Quarrel 4y ago
If their reasoning was to spur on development in the reverse engineering space they've done amazing things by releasing this. The obvious step 1) Lots of people use & improve ghidra, write plugins etc. It is good now, but in 5 years it could be best in class. step 2) their biggest & bestest competitor IDA has massively accelerated the rate of their development, engagement & community responsiveness. IDA was this slow moving dinosaur that had good ideas and people that has been poked to life by a proper competitor. If the NSA wants a robust RE scene, with experience engineers and good tools, then I think they've done themselves a massive favour by releasing and stewarding the development of ghidra as an OSS tool.
- jdm2212 4y ago
  Ghidra was already best-in-class, and the goal isn't to build a community around Ghidra -- it's to spur recruiting by giving people a taste of how far ahead the NSA is of what's commercially available. If this is what they can give away for free, imagine what you can use if you go work there.
  - Quarrel 4y ago
    What are you using it for that you think it is best in class? For everything I use it for IDA is still well ahead. I only do x86 work, so maybe in other areas, but I doubt it? The decompiler is getting better, but still has quite a ways to go, the plugin support is way behind, etc etc.
    - mdaniel 4y ago
      Maybe they meant the class of open source reverse engineering tools Just as others have mentioned, it can be problematic to even buy IDA Pro, so if Jane Haqor is able to get started with Ghidra and then develops a passion for the space, then that makes Ghidra best for that class, also
  - govnah 4y ago
    The version they (and their partner agencies) use internally is even better. Some of these additional plugins will likely never see the light of day publicly as they're either too tied into internal systems or otherwise deemed too sensitive, but they're very impressive.
    - bpye 4y ago
      There's a reference on WikiLeaks [0] which has always intrigued me: > ... plugins that allow for additional functionality (Cryptanalysis, interaction with OllyDbg, the Ghidra Debugger). We've got the debugger, but I don't think we have the OllyDbg plugin and certainly nothing with cryptanalysis. [0] - https://wikileaks.org/ciav7p1/cms/page_51183656.html https://wikileaks.org/ciav7p1/cms/page_51183656.html
jdm2212 4y ago
They open source stuff that is no longer a differentiated capability (hence no harm in releasing it to the public), and the goal is recruiting. Same as any tech company that open sources projects because it'll attract positive attention from hiring prospects.

beauHD 4y ago

> I would be curious if anyone knows what their filter, reasoning, etc - for open sourcing X vs Y. NSA is both red team and blue team. This is a blue team tool used by reverse engineers to analyze malware, so it was NSA's little gift to researchers, an agency known for hoarding secrets for our 'security'.

jasonladuke0311 4y ago
> This is a blue team tool used by reverse engineers to analyze malware It's also a red team tool for binary exploitation. EDIT: The cynic in me posits it was used far more for exploit development than for analyzing malware, unless that had offensive applications too. But I don't know anything, I never worked there.

Quarrel 4y ago

If their reasoning was to spur on development in the reverse engineering space they've done amazing things by releasing this. The obvious step 1) Lots of people use & improve ghidra, write plugins etc. It is good now, but in 5 years it could be best in class. step 2) their biggest & bestest competitor IDA has massively accelerated the rate of their development, engagement & community responsiveness. IDA was this slow moving dinosaur that had good ideas and people that has been poked to life by a proper competitor. If the NSA wants a robust RE scene, with experience engineers and good tools, then I think they've done themselves a massive favour by releasing and stewarding the development of ghidra as an OSS tool.

jdm2212 4y ago
Ghidra was already best-in-class, and the goal isn't to build a community around Ghidra -- it's to spur recruiting by giving people a taste of how far ahead the NSA is of what's commercially available. If this is what they can give away for free, imagine what you can use if you go work there.
- Quarrel 4y ago
  What are you using it for that you think it is best in class? For everything I use it for IDA is still well ahead. I only do x86 work, so maybe in other areas, but I doubt it? The decompiler is getting better, but still has quite a ways to go, the plugin support is way behind, etc etc.
  - mdaniel 4y ago
    Maybe they meant the class of open source reverse engineering tools Just as others have mentioned, it can be problematic to even buy IDA Pro, so if Jane Haqor is able to get started with Ghidra and then develops a passion for the space, then that makes Ghidra best for that class, also
- govnah 4y ago
  The version they (and their partner agencies) use internally is even better. Some of these additional plugins will likely never see the light of day publicly as they're either too tied into internal systems or otherwise deemed too sensitive, but they're very impressive.
  - bpye 4y ago
    There's a reference on WikiLeaks [0] which has always intrigued me: > ... plugins that allow for additional functionality (Cryptanalysis, interaction with OllyDbg, the Ghidra Debugger). We've got the debugger, but I don't think we have the OllyDbg plugin and certainly nothing with cryptanalysis. [0] - https://wikileaks.org/ciav7p1/cms/page_51183656.html https://wikileaks.org/ciav7p1/cms/page_51183656.html

jdm2212 4y ago

They open source stuff that is no longer a differentiated capability (hence no harm in releasing it to the public), and the goal is recruiting. Same as any tech company that open sources projects because it'll attract positive attention from hiring prospects.