Hacker News Reader

Comment by O__________O | Hacker News Reader

This is likely NSA’s most popular repository on GitHub, but worth checking out their others too:

- https://github.com/NationalSecurityAgency

Prior HN coverage is here:

- https://hn.algolia.com/?q=https%3A%2F%2Fgithub.com%2FNationa...

I would be curious if anyone knows what their filter, reasoning, etc - for open sourcing X vs Y. In case of Ghidra, think its existence was originally revealed to the public via WikiLeaks in 2017; might be wrong, but think the software was posted too — for sure though was open sourced two years later in 2019.

View on HN

If their reasoning was to spur on development in the reverse engineering space they've done amazing things by releasing this.

The obvious step 1) Lots of people use & improve ghidra, write plugins etc. It is good now, but in 5 years it could be best in class.

step 2) their biggest & bestest competitor IDA has massively accelerated the rate of their development, engagement & community responsiveness. IDA was this slow moving dinosaur that had good ideas and people that has been poked to life by a proper competitor.

If the NSA wants a robust RE scene, with experience engineers and good tools, then I think they've done themselves a massive favour by releasing and stewarding the development of ghidra as an OSS tool.

Ghidra was already best-in-class, and the goal isn't to build a community around Ghidra -- it's to spur recruiting by giving people a taste of how far ahead the NSA is of what's commercially available. If this is what they can give away for free, imagine what you can use if you go work there.

The version they (and their partner agencies) use internally is even better. Some of these additional plugins will likely never see the light of day publicly as they're either too tied into internal systems or otherwise deemed too sensitive, but they're very impressive.

There's a reference on WikiLeaks [0] which has always intrigued me:

> ... plugins that allow for additional functionality (Cryptanalysis, interaction with OllyDbg, the Ghidra Debugger).

We've got the debugger, but I don't think we have the OllyDbg plugin and certainly nothing with cryptanalysis.

[0] - https://wikileaks.org/ciav7p1/cms/page_51183656.html

What are you using it for that you think it is best in class?

For everything I use it for IDA is still well ahead.

I only do x86 work, so maybe in other areas, but I doubt it? The decompiler is getting better, but still has quite a ways to go, the plugin support is way behind, etc etc.

Maybe they meant the class of open source reverse engineering tools

Just as others have mentioned, it can be problematic to even buy IDA Pro, so if Jane Haqor is able to get started with Ghidra and then develops a passion for the space, then that makes Ghidra best for that class, also

> I would be curious if anyone knows what their filter, reasoning, etc - for open sourcing X vs Y.

NSA is both red team and blue team. This is a blue team tool used by reverse engineers to analyze malware, so it was NSA's little gift to researchers, an agency known for hoarding secrets for our 'security'.

> This is a blue team tool used by reverse engineers to analyze malware

It's also a red team tool for binary exploitation.

EDIT: The cynic in me posits it was used far more for exploit development than for analyzing malware, unless that had offensive applications too. But I don't know anything, I never worked there.

They open source stuff that is no longer a differentiated capability (hence no harm in releasing it to the public), and the goal is recruiting. Same as any tech company that open sources projects because it'll attract positive attention from hiring prospects.

Reply on news.ycombinator.com