3 ms·

Around $3k for a one year floating license, then $4k per architecture, at least according to this price list: https://www.componentsource.com/product/ida-pro-he

Around $3k for a one year floating license, then $4k per architecture, at least according to this price list: https://www.componentsource.com/product/ida-pro-hex-rays-decompilers/prices https://www.componentsource.com/product/ida-pro-hex-rays-dec...

tptacek 4y ago
That's for floating licenses, though, which are like 2x the price of the fixed and named licenses, right? IDA has a problem where, for some shops, it really makes sense to just have one concurrent IDA user, because IDA is like 10-15% of the work hours --- but it's a critically important 10-15%. So they're super careful to charge for the ability to rotate a team of consultants through the same IDA license. We had a client, a decade or so ago, that brought us in to do IDA-based vulnerability research work. We wrote some blog posts about the work, and it was so unusual for any of their clients to have that licensing arrangement that IDA (this is in the Pierre era, not the Hex-Rays era) publicly accused us of pirating our copy (which was annoying, because we couldn't out our client, but they absolutely did have the licensing worked out for this.) It's all super off-putting. But IDA is in sort of a bind, because there just aren't that many users for their ultra-hyper-specialized product. You can have the very best decompiler in the world and you're still going to be a rounding error compared to companies like Figma, because (1) not that many people use disassemblers and (2) less and less software is written in C/C++ every year.
- pseudo0 4y ago
  It's not that much cheaper. $1,935.50 for a one year fixed or named license, then $2,709.70 per architecture. Let's say you need the typical four for x86 and ARM, that's over $12k per seat. A lot of companies would balk at that.
  - tptacek 4y ago
    I've long since lost track of the pricing here, but the per-arch stuff is for the decompiler, right?
    - pseudo0 4y ago
      Yeah, that's for the decompiler. And I just saw your edit and agree that they are in a tricky spot. Their product is hyper-specialized and they deserve to get paid for the craft and expertise that they have put into their product, but at the same time they have been a significant barrier to entry for people getting into SRE due to the prohibitive cost. Their new offering of a limited license for $365 a year is a step in the right direction, but they only took that step after competition forced their hand. Edit: Ironically the NSA is the entity commoditizing their complement here, getting an in-house SRE tool and making it easier to hire students out of college with skills they want.
      - tptacek 4y ago
        Sure! Don't get me wrong: they an extremely off-putting company. I just think I get where they're coming from.
      - ev1 4y ago
        Can you even get the limited licence? It feels like they are comically hostile, ask for a huge amount of really unnecessary things, "KYC procedures", for a $1/day commodity software
- q-big 4y ago
  > You can have the very best decompiler in the world and you're still going to be a rounding error compared to companies like Figma, because (1) not that many people use disassemblers (1) could be changed by making a decent offer to hobbyists that they can't refuse, and making the buying experience for them hassle-free.

tptacek 4y ago

That's for floating licenses, though, which are like 2x the price of the fixed and named licenses, right? IDA has a problem where, for some shops, it really makes sense to just have one concurrent IDA user, because IDA is like 10-15% of the work hours --- but it's a critically important 10-15%. So they're super careful to charge for the ability to rotate a team of consultants through the same IDA license. We had a client, a decade or so ago, that brought us in to do IDA-based vulnerability research work. We wrote some blog posts about the work, and it was so unusual for any of their clients to have that licensing arrangement that IDA (this is in the Pierre era, not the Hex-Rays era) publicly accused us of pirating our copy (which was annoying, because we couldn't out our client, but they absolutely did have the licensing worked out for this.) It's all super off-putting. But IDA is in sort of a bind, because there just aren't that many users for their ultra-hyper-specialized product. You can have the very best decompiler in the world and you're still going to be a rounding error compared to companies like Figma, because (1) not that many people use disassemblers and (2) less and less software is written in C/C++ every year.

pseudo0 4y ago
It's not that much cheaper. $1,935.50 for a one year fixed or named license, then $2,709.70 per architecture. Let's say you need the typical four for x86 and ARM, that's over $12k per seat. A lot of companies would balk at that.
- tptacek 4y ago
  I've long since lost track of the pricing here, but the per-arch stuff is for the decompiler, right?
  - pseudo0 4y ago
    Yeah, that's for the decompiler. And I just saw your edit and agree that they are in a tricky spot. Their product is hyper-specialized and they deserve to get paid for the craft and expertise that they have put into their product, but at the same time they have been a significant barrier to entry for people getting into SRE due to the prohibitive cost. Their new offering of a limited license for $365 a year is a step in the right direction, but they only took that step after competition forced their hand. Edit: Ironically the NSA is the entity commoditizing their complement here, getting an in-house SRE tool and making it easier to hire students out of college with skills they want.
    - tptacek 4y ago
      Sure! Don't get me wrong: they an extremely off-putting company. I just think I get where they're coming from.
    - ev1 4y ago
      Can you even get the limited licence? It feels like they are comically hostile, ask for a huge amount of really unnecessary things, "KYC procedures", for a $1/day commodity software
q-big 4y ago
> You can have the very best decompiler in the world and you're still going to be a rounding error compared to companies like Figma, because (1) not that many people use disassemblers (1) could be changed by making a decent offer to hobbyists that they can't refuse, and making the buying experience for them hassle-free.