5 ms·
YARA is dead, long live YARA-X
- rwmj 2y agoYara seems to be quite widely used by the UK police for digital forensics (or at least by the companies that supply their tools).
- lima 2y agoYara is pretty much the industry standard for detection rules now.
- _8j50 2y agoIf all you have is a Rusty hammer, everything is a nail. Third party module dev is harder now for yara-x. And I wonder how the python module will turn out. Neither 3rd party/go clients nor the official virustotal C client could meet my requirements, I had to write a scanner in python on at least two different times and having to do it again soon. The main issues are resource usage, result shuffling and supporting very large proprietary ruled that depend on specific yara modules. Crowsresponse by crowdstrike is better too but it still has limits. Python is the best way to yara.
- serhack_ 2y agoTL;DR: https://github.com/VirusTotal/yara-x https://github.com/VirusTotal/yara-x
- Ar-Curunir 2y agoIt's a pretty short article. You really have to hate reading to not be able get through it...
- serhack_ 2y agoApart from the website itself, there're no links of YARA-X repo in that article
- lima 2y agoThe risk with such rewrites is ending up with a Python 3 situation and an ecosystem split. Sounds like YARA-X is (mostly) a stricter subset of YARA, and it's easy to write rules that are valid for both: https://virustotal.github.io/yara-x/docs/writing_rules/differences-with-yara/ https://virustotal.github.io/yara-x/docs/writing_rules/diffe... Although I wonder how long it'll stay that way? It'll be very tempting to add new features to YARA-X that won't be backported to YARA.
- andrewflnr 2y ago> At VirusTotal, we have been running YARA-X alongside YARA for a while, scanning millions of files with tens of thousands of rules, and addressing discrepancies between the two. This is pretty encouraging as far as compatibility. I hope they keep doing this.
- petiepooo 2y agoYARA-X is dead, long love the next fad
- kingforaday 2y agoAfter reading the article, a fun thought popped into my head. Who has the right to determine if a project like this is dead or EOL'd? Is it the original author to make that declaration or when it is under BSD license, wide community-use, and support -- when does a project like this truly become dead or EOL'd?
- dartos 2y agoWell EOL usually means something like “end of official support, active development, and security patches” so the owner/creator/foundation usually chooses when. “Dead” is usually a colloquialism, so if enough people call it dead, it is.
- anamexis 2y agoWhoever owns the canonical repo (also, any relevant trademarks) has a lot of power in this situation. The community can certainly fork it, but then you start asking if the fork is a new project.
- patmorgan23 2y agoThe official maintainers say they won't be maintaining the repo any more. Anyone else is always welcome to fork and form their own project to continue to maintain the software.
- cess11 2y agoThe article backs on the claim in the title, making the title kind of clickbait: "Is YARA really dead? Despite the dramatic title of this post, YARA is not actually dead. I’m aware that many people and organizations rely on YARA to get important work done, and I don’t want to let them down. YARA is still being maintained, and future releases will include bug fixes and minor features. However, don’t expect new large features or modules. All efforts to enhance YARA, including the addition of new modules, will now focus on YARA-X."
- skybrian 2y agoFor curious onlookers, here's an explanation of what Yara does: https://virustotal.github.io/yara/ https://virustotal.github.io/yara/
- banish-m4 2y agoYARA is on every Mac and about half of corporate laptops.
- fanf2 2y agoHere’s Apple’s web page describing how they use YARA https://support.apple.com/en-gb/guide/security/sec469d47bd8/web https://support.apple.com/en-gb/guide/security/sec469d47bd8/...
- nsonha 2y agowas this made in Melbourne, Australia by any chance?