psifertex

5 ms·

1.
by psifertex 5mo ago
It's not abhorrent. It's quite common and the correct thing to do here. Them not disclosing doesn't make you safer. The people that want to abuse this could be actively exploiting it shortly after the commit went live. Waitin
2.
by psifertex 5mo ago
They did not, in fact, botch anything. They notified the responsible party and followed a practice that is pretty much the accepted norm (and for good reason). How recursive should their notifications be? Just the tip three distros? The top
3.
by psifertex 5mo ago
I doubt it will and I hope it doesn't. External security research happens for one of only a few reasons typically: 1) hobbyists who are learning or just like to do it for fun 2) bug bounties (good luck with those in most open source) 3
4.
by psifertex 5mo ago
You could try to make that case either way, but as has been pointed out by others all over this thread, the system we've landed on (90/+30) is industry standard after over two and a half decades of experimentation. Anything else i
5.
by psifertex 7mo ago
I'm curious what you would consider better UX? We have actually been more inspired by Jetbrains lately than VS Code. Take that for what you will. We do try to pick simple sane defaults while still allowing enough customization to adapt
6.
by psifertex 1y ago
IDEs have changed a lot in the last 50 years. Just like we shouldn't advocate for hand writing assembly for all code, we shouldn't be stuck using CLI tooling the same way. I share your apprehension regarding the current AI landsca
7.
by psifertex 2y ago
Yes, actually, if you know someone there they were selling extras: https://defcon.org/html/links/dc-news.html
8.
by psifertex 2y ago
I don't know why people think this, you're not the first person I've heard it from either. First, I literally saw them do shots during a talk yesterday for some first-time presenters. Secondly that WASN'T the "old d
9.
by psifertex 3y ago
Can I just say, thanks to the person who posted this for waiting until this week to do so. (Side note: I suspect it was due to the recent coverage from C++ Weekly which is a great resource: https://www.youtube.com/watch?v=h
10.
by psifertex 3y ago
Yes, lets! And before hacker summer camp when we're way way too busy! :-)
11.
by psifertex 3y ago
Binary Ninja likewise is empty and keeps up just fine as well. It's not a coincidence that the two commercial products that are funding it are both confident enough to put their stuff online like this. And it's no conspiracy theor
12.
by psifertex 3y ago
Yup, I'm aware of both of those, but none of those tools listed so far are intended for the IR to be for human-consumable unlike disassemblers and decompilers. You think disassembly is verbose compared to a decompiler? Go look at the e
13.
by psifertex 3y ago
That was indeed the logic. The two main commercial solutions included (Binary Ninja made by Vector 35, where I'm one of hte founders) and Hex-Rays both pay for all the hosting costs. And it's not particularly cheap -- there's
14.
by psifertex 3y ago
IRs aren't generally suited toward small snippets of examination by human when you're starting with a full binary. I would imagine something like that would only work well when done for very small bits of assembly. Likewise, you m
15.
by psifertex 3y ago
We know! Similarly, the GH repo is actually the Decompiler Explorer: https://github.com/decompiler-explorer/decompiler-explorer/
16.
by psifertex 3y ago
I do remember dogpile, but as one of the folks who named it, nope, that wasn't a conscious influence!
17.
by psifertex 4y ago
It's been on the dev builds enabled by default for several months now and no longer labelled beta, but we're in the middle of a release process right now so at some point soon this week the current stable will have a full debugger
18.
by psifertex 4y ago
Was this due to load or server restarts or are you still seeing errors? Pass me a GUID either publicly or privately (my handle on twitter accepts DMs or an email address at my handle.com as a domain) if you don't mind and I can take a
19.
by psifertex 4y ago
Binary Ninja can as well (sorry for the delay, been on vacation this week) though none of the tools will download and use PDBs that might be available via public servers or otherwise by default in the configuration we're using on dogbo
20.
by psifertex 4y ago
And both companies behind those licenses (hi, I'm one of them!) donated licenses to support this. That said, you're right. It's unlikely we'd ship our entire binaries plus code to live in-browser though the amount wasm s
21.
by psifertex 4y ago
This is actually why we chose _not_ to implement no-more-gotos for Binary Ninja's HLIL! Code is actually more readable with gotos in some situations and trying to force their elimination hurts readability.
22.
by psifertex 4y ago
Nope, not when you ask them and they provide the license. This is being run with the permission of all the commercial products. In fact, we (Binary Ninja) and Hex-Rays (once I figure out the exact mechanism with Ilfak) are the ones actually
23.
by psifertex 4y ago
Nope, Ilfak gave us a license for it and as Binary Ninja devs we're using a legitimate licensed copy of Binary Ninja as well. All above board and we're hoping to add more commercial decompilers in the future as well as we can inte
24.
by psifertex 4y ago
Thanks! We debated it some internally and I'm glad it won out, I think it's worth it. Plus, it has a nice logo that goes with it.
25.
by psifertex 4y ago
Yeah, sorry about that. We're working on getting it up again but no promises. I'm on vacation in Europe while the rest of the team is about to head to sleep so might be a bit before we have it more stable.
26.
by psifertex 4y ago
Sorry for the outages, friends. We're actively working on getting it able to handle higher load but we knew that if we hit HN we'd be swamped no matter what we did. We're spinning up more workers and fixing obvious perf issue
27.
by psifertex 4y ago
No need to use a password manager. Simply search email history for the very first usage of the email...
28.
by psifertex 4y ago
I agree there were many others (beyond even these I can think of a several), but I think Ryan was mainly referring to was how many were regular online CTFs at the time. Wasn't both barcode-shmarcode and oCTF both more in-person events
29.
by psifertex 5y ago
So I do a weekly live-stream which is a bit much to follow to just casually learn: https://youtube.com/c/vector35 But more importantly, there are video excerpts for some basic features which should at least help with u
30.
by psifertex 5y ago
Totally fair -- breadth of architecture support is definitely one of the biggest strengths of Ghidra! IDA does as well but purely for disassembly which isn't nearly as useful. EDIT: But yeah, we designed our lifting to be as simple as

More ›