Rizin – a free and open-source Reverse Engineering framework
rizin.re
rizin.re
I'm curious...if they are the core development team, what stopped them from changing the environment? Doesn't the core team on an open-source project kind of set the tone and culture for that project? Or am I missing something?
The core team is still at r2
A story is missing here, and I think it should be told. Unfortunately, I don't know what it is. However, people don't spontaneously decide to fork a project, and the details here are too vague for a value judgment.
Firstly, I'd like to thank the project for doing actual tangible work before announcing a fork. If you are going to fork a project over internal disagreements, you have to understand and appreciate that the world doesn't have time to dig into literally 10,000 different project's internal affairs to try to guess which side of a fight to take; most people would prefer to let the contributors decide who wins by virtue of mindshare, and then pick the technically better project as a result. Rizin is off to at least some start here, having at least one major feature and some aspirations.
Firstly, why did this project start? To get a better idea of what's going on, let's analyze the timeline.
The project appears to have kicked off on October 1st, at least symbolically. The first PR seems to be a rename:
https://github.com/rizinorg/rizin/pull/2
What are the values of the Rizin org and what do they define as welcoming vs unwelcoming?
Since I don't know for sure, I can take a cursory glance at the types of PRs that exist within Rizin so far.
- Use Meson for macOS CI #3 -- A CI related change.
- Other renames in man and small places #4 -- Looks like more renames. Was pushed manually to master for some reason? Note also that it seems the primary branch has been renamed from 'master' since it was mentioned in this PR.
- Use R2PIPE_* -> RZ_PIPE_* env vars #5 -- More radare->rizon renames.
...
- Import patches #10 -- First import of Radare2 patches that I have noticed.
...
- Add new Projects Implementation #12 -- First major feature I can find.
...
- Create CODE_OF_CONDUCT.md #93 -- The project gains a code of conduct. Arguably the first interesting change that demonstrates the values of the project in some form.
...
- Change the "anal" abbreviation to "Analysis" in Code #117 -- December 6th. Interestingly, the source branch 'no-more-anal', reads a lot like a joke of a similar fashion to what is apparently unacceptable. This PR is the next change that demonstrates the values of the project.
- Add a fortune #118 -- "Rizin is the vegan pineapple pizza of reverse engineering tools." That's funny. I wonder if that's a bit of tongue-in-cheek self-awareness about the optics of forking a project over "ideological" disagreements.
...Ultimately, most of the PRs fall into the category of:
- 21 PRs: CI/infrastructure changes.
- 18 PRs: importing Radare2 changes.
- 9 PRs: renaming Radare2 -> Rizin
...of the 100 or so PRs. A lot of the others are minor changes like documentation updates, but it's hard to enumerate them into groups easily.
After surveying the PRs, it is no clearer exactly what motivates the project.
Searching through Radare PRs get no closer. Looking for PRs from around the time the project is created, I don't see many points of contention. I see some other discussions about fortunes but really not many. Searching through issues, much doesn't stand out. Fortunes doesn't appear to come up much in issues, with the search returning nothing from this year.
---
With that excavation out of the way, I'd like to turn my attention to the claim that Rizin is made up of "core Radare2 developers." This should be relatively easy to confirm. Firstly, we can look at the developers listed in AUTHORS.md:
Mentors and co-maintainers
--------------------------
Most active in community, setting up CI servers, regression tests, esil, coverity, blog, release notes, ..
- xvilka
- condret
- crowell
- jvoisin
- maijin
- user "radare", apparently goes by the alias pancake, seems to be the primary maintainer. Very active all the way from 2010 to 2019, where things seem to have tapered a bit. 12,040 commits, 1,308,025 ++, 911,136 --
- user "alvarofe", was active during a couple of years, is mentioned specially in the AUTHORS.md file. 852 commits, 52,922 ++, 43,348 --
- user "XVilka", pretty active since around 2013. 834 commits, 92,857 ++, 54,658 --
- user "kazarmy", active since 2017. 779 commits, 24,498 ++, 17,779 --
- user "ret2libc", with a somewhat sporadic looking graph with pretty large activity spikes since 2015 or so. 673 commits, 170,629 ++, 89,518 --
Alright. Now onto the Rizinorg team on GitHub, it is comprised of the following members:
- user "ITAYC0HEN," Itay Cohen.
- user "kazarmy," Khairul Azhar Kasmiran.
- user "ret2libc," Riccardo Schirone.
- user "thestr4ng3r," Florian Märkl.
- user "wargio," Giovanni.
- user "XVilka," Anton Kochkov.
Some notes to make:
- "radare" aka pancake is not present. Obviously, otherwise it would beg the question why a fork is needed.
- "xvilka" is one of the contributors who was specially called out in the README as a core contributor.
- All of these developers were contributors to radare2 who contributed more than minor bits. This is a good sign for Rizin, of course.
So not every core developer is involved in Rizin, but the Rizin team has plenty of developers who have worked a lot on Radare2.
---
The next aspect that's interesting is Cutter moving over. Who works on Cutter? There is no similar AUTHORS.md in Cutter, however it is in the Rizin org now. This is interesting. I think this may have been the last step before launching Rizin. You can see that it appears Cutter was under Radareorg until very recently:
https://web.archive.org/web/20201208101941/https://github.co...
Further, we can look at the top Github contributors:
- user "thestr4ng3r", Florian Märkl. 558 commits, 47,091 ++, 49,926 --
- user "xarkes" - do not appear to be terribly active anymore. 364 commits, 47,370 ++, 55,610 --
- user "ITAYC0HEN," Itay Cohen. 196 commits, 12,434 ++, 5,895 --
- user "karliss," 165 commits, 22,387 ++, 11,620 --
- user "fcasal," 83 commits, 6,327 ++, 823 --
Notably, thestr4ng3r and ITAYC0HEN are also part of the Rizinorg team. karliss is not despite seeming to be a major part of maintaining Cutter up until recently.
It looks like Cutter operated the Rizin changes in private for some reason, until relatively recently. You can see evidence of this here:
https://github.com/rizinorg/cutter/pull/2496/files
which I find interesting.
---
All of this leaves me feeling very mixed. I don't feel we really know what the motivations for Rizin are.
The above-ground claim is that the reason why Rizin exists is due to an unwelcoming environment. Based on the kerfuffles with fortunes and renaming anal to analysis, I can only suspect that this is due to issues such as offensive language. However, the project was forked on October 1st before I can find much evidence of the fortunes problem, so it must've been brewing already. But what's weirder than that is that the fork was done by "thestr4ng3r," one of the primary developers of Cutter, who, as far as I can tell, does not seem to care that much about political correctness, at least based on the very tiny amount of information I can exact from these public channels, based on discussions that occurred after the fork had already begun:
https://github.com/radareorg/radare2/pull/17980
(An aside: I am not attempting to 'shame' anyone, just making observations based on publicly available information. Make your own judgements.)
That last part, "After the fork had already begun," is where things get interesting. It is possible that there were disagreements with pancake in private, or other bad conduct that I just happen to be missing, but above all I question the sincerity of the reasoning for this fork. I would like the maintainers to clarify what is going on here. Otherwise, it feels like there is some kind of power struggle going on, and that users are being roped into it without hearing the real reasons why. The stuff involving Cutter is especially interesting due to the fact that upstream Cutter is now based on Rizin, leaving Linux packagers with a fairly complicated conundrum that basically requires value judgements to resolve.
---
I can only imagine that somebody is going to be upset by some of what I'm doing here, but please understand that I am simply trying to figure out what is going on. I have a strong feeling that there might be a lot more going on here that will surface later on.
As far as attempts to fork a project based on non-technical disagreements, Rizin seems well-positioned, with control over Cutter and some core contributors on board.
Let's see what happens next...
For now, I am very likely to continue using r2, at least until Linux packagers decide to switch. They might as Cutter's choice is likely going to force the issue.
---
Yet another weird sidenote. I think PR #17980 discussion is full of interesting nuance.
User "FFY00," Filipe Laíns, created this PR. They appear to have contributed to Radare2 once in the past to add a small feature in 2017 (#9054.) They don't appear to have contributed to Rizin yet.
User "FFY00," Filipe Laíns says:
> @trufae this is what people are referring to when they criticize radare2. People are not out to get you, and do not hate radare2 just because... They are referring to this kind of behavior, which is harmful to others.
This is some solid evidence that there is some kind of reputation and pre-existing conflict regarding pancake's conduct (note that @trufae appears to be another Github account of pancakes?)
Continuing, user "FFY00," Filipe Laíns says:
> I don't understand how having these stupid sentences show up when you start the program is worth possibly hurting users.
This is a particularly strange sentence because they are, as far as I can tell, not shown at startup by default, and haven't been for years. In fact, their own commit description seems to be aware:
> Even if they are not active by default, they should have no place here if you are trying to be a welcoming project.
I have no idea what to conclude from this. It must just be an accident.
Firstly, the fortunes mess. It turns out that this is unrelated to the Rizin fork. That fortunes PR happened because of a tweet, which gained moderate popularity, on November 26th, criticizing the fortunes.nsfw file. (Please do not harass this person over their tweet.) ...which occurred after the fork. As far as I can ascertain, the fortunes mess simply doesn't play into this. Unfortunately, this same person seems to think the fork is about that, which is understandable, due to the apparent timelines. On December 6th, they accused Rizin of being an elaborate troll. (I repeat: please do not try to find these tweets and harass them. Disagree in your head if you need to.) THIS tweet is the source of the Reddit comment that is so intriguing. But it's wrong. This isn't about fortunes.nsfw. The Rizin announcement may be vague, but it's honest: it's really about major disagreements, both technical and otherwise. But I will get to that later.
---
OK, part 2. I was wrong to conclude that the Github team was representative of all of the users that are moving to Rizin. It turns out it's more.
So far, you can additionally see pull requests from kazarmy (#2 contributor to radare,) yossizap (#11 contributor to radare.) In addition, because this fork is so relatively new, there are almost certainly other developers who have moved or will move over. An especially strong signal of this is how many of the developers who are high up in the contributors list do not appear recently in the Radare2 pull requests; a majority of open pull requests right now are actually from pancake themselves.
In addition, today I can see there are more users on the GitHub team, including Cutter developer "karliss" and Github user "kazarmy", Khairul Azhar Kasmiran. In addition, we can now see user "officialcjunior", Aswin C, one of the top contributors to the r2book in the last year.
---
And finally. The real reason. To most people reading these comments, we are outsiders, but there is a clear sentiment within the r2 community that it is unwelcoming, and there is some strong evidence for this.
For example, there was apparently, at some point, a repository dedicated to... collecting Radare2 hate into Github issues. This is oddly condescending, but what's more concerning is that this seemed to be a way of getting back at anyone who said anything negative about the project.
https://web.archive.org/web/20180612221427if_/https://github...
Mention of r2hate exists on social media. A very well-respected engineer also noted, "...i've been informed that they coped by mocking me in private." Interesting indeed.
If you keep digging you can find more and more evidence that the unprofessionalism of how radare2 was being ran was becoming a drain on the project, and that the issues that lead to its forking are multi-faceted, but absolutely include technical disagreements.
Here are some quotes. I have changed the wording slightly to discourage people from harassing folks, but you can find them if you try hard enough. If you must, please do not interact; it's bad netiquette. I'm just trying to illustrate the problem.
> ignoring everyone's thoughts or feelings or ideas when you don't "get" them 100% is part of why people were calling you an asshole
> In all seriousness that is unbelievably childish. I can just imagine them linking to this exact tweet in one of those "issues" and chuckling about how we're the ones being dicks here without realizing the irony of posting "hatemail".
You can find quotes and threads about it all over. And some of them are people I really respect and trust.
There is also some interesting discourse about Radare2's technical direction, including this comment that seems to have resonated with a couple of people despite being hidden on an old April fools PR.
https://github.com/radareorg/radare2/pull/16392#issuecomment...
In other words, this isn't a stunt or a knee-jerk reaction. Rizin is likely the fork you want.
I’m not talking about software politics here (licence, business model) but rather « real world » politics