YARA is dead, long live YARA-X | Hacker News Reader

YARA is dead, long live YARA-X

virustotal.github.io

132 pointsserhack_22 comments

The risk with such rewrites is ending up with a Python 3 situation and an ecosystem split. Sounds like YARA-X is (mostly) a stricter subset of YARA, and it's easy to write rules that are valid for both:

https://virustotal.github.io/yara-x/docs/writing_rules/diffe...

Although I wonder how long it'll stay that way? It'll be very tempting to add new features to YARA-X that won't be backported to YARA.

> At VirusTotal, we have been running YARA-X alongside YARA for a while, scanning millions of files with tens of thousands of rules, and addressing discrepancies between the two.

This is pretty encouraging as far as compatibility. I hope they keep doing this.

For curious onlookers, here's an explanation of what Yara does:

https://virustotal.github.io/yara/

Yara seems to be quite widely used by the UK police for digital forensics (or at least by the companies that supply their tools).

Yara is pretty much the industry standard for detection rules now.

After reading the article, a fun thought popped into my head. Who has the right to determine if a project like this is dead or EOL'd? Is it the original author to make that declaration or when it is under BSD license, wide community-use, and support -- when does a project like this truly become dead or EOL'd?

Well EOL usually means something like “end of official support, active development, and security patches” so the owner/creator/foundation usually chooses when.

“Dead” is usually a colloquialism, so if enough people call it dead, it is.

The corollary is that if you didn't have any support to begin with, as is the case with most open source projects, EOL is pretty meaningless concept.

The OSS analogue would be “unmaintained” I guess.

Whoever owns the canonical repo (also, any relevant trademarks) has a lot of power in this situation. The community can certainly fork it, but then you start asking if the fork is a new project.

The official maintainers say they won't be maintaining the repo any more. Anyone else is always welcome to fork and form their own project to continue to maintain the software.

The article backs on the claim in the title, making the title kind of clickbait:

"Is YARA really dead? Despite the dramatic title of this post, YARA is not actually dead. I’m aware that many people and organizations rely on YARA to get important work done, and I don’t want to let them down.

YARA is still being maintained, and future releases will include bug fixes and minor features. However, don’t expect new large features or modules. All efforts to enhance YARA, including the addition of new modules, will now focus on YARA-X."

If all you have is a Rusty hammer, everything is a nail.

Third party module dev is harder now for yara-x. And I wonder how the python module will turn out.

Neither 3rd party/go clients nor the official virustotal C client could meet my requirements, I had to write a scanner in python on at least two different times and having to do it again soon. The main issues are resource usage, result shuffling and supporting very large proprietary ruled that depend on specific yara modules.

Crowsresponse by crowdstrike is better too but it still has limits. Python is the best way to yara.

> Third party module dev is harder now for yara-x.

In what way / what's harder about it?

For one, less people know rust. Also, having to port your c modules.

YARA is on every Mac and about half of corporate laptops.

Here’s Apple’s web page describing how they use YARA https://support.apple.com/en-gb/guide/security/sec469d47bd8/...

was this made in Melbourne, Australia by any chance?

TL;DR: https://github.com/VirusTotal/yara-x

It's a pretty short article. You really have to hate reading to not be able get through it...

Apart from the website itself, there're no links of YARA-X repo in that article

YARA-X is dead, long love the next fad

Reply on news.ycombinator.com