YARA is dead, long live YARA-X

The risk with such rewrites is ending up with a Python 3 situation and an ecosystem split. Sounds like YARA-X is (mostly) a stricter subset of YARA, and it&#x27;s easy to write rules that are valid for both:<p><a href="https:&#x2F;&#x2F;virustotal.github.io&#x2F;yara-x&#x2F;docs&#x2F;writing_rules&#x2F;differences-with-yara&#x2F;" rel="nofollow">https:&#x2F;&#x2F;virustotal.github.io&#x2F;yara-x&#x2F;docs&#x2F;writing_rules&#x2F;diffe...</a><p>Although I wonder how long it&#x27;ll stay that way? It&#x27;ll be very tempting to add new features to YARA-X that won&#x27;t be backported to YARA.

For curious onlookers, here&#x27;s an explanation of what Yara does:<p><a href="https:&#x2F;&#x2F;virustotal.github.io&#x2F;yara&#x2F;" rel="nofollow">https:&#x2F;&#x2F;virustotal.github.io&#x2F;yara&#x2F;</a>

Yara seems to be quite widely used by the UK police for digital forensics (or at least by the companies that supply their tools).

After reading the article, a fun thought popped into my head. Who has the right to determine if a project like this is dead or EOL&#x27;d? Is it the original author to make that declaration or when it is under BSD license, wide community-use, and support -- when does a project like this truly become dead or EOL&#x27;d?

If all you have is a Rusty hammer, everything is a nail.<p>Third party module dev is harder now for yara-x. And I wonder how the python module will turn out.<p>Neither 3rd party&#x2F;go clients nor the official virustotal C client could meet my requirements, I had to write a scanner in python on at least two different times and having to do it again soon. The main issues are resource usage, result shuffling and supporting very large proprietary ruled that depend on specific yara modules.<p>Crowsresponse by crowdstrike is better too but it still has limits. Python is the best way to yara.

YARA is on every Mac and about half of corporate laptops.

was this made in Melbourne, Australia by any chance?

TL;DR: <a href="https:&#x2F;&#x2F;github.com&#x2F;VirusTotal&#x2F;yara-x">https:&#x2F;&#x2F;github.com&#x2F;VirusTotal&#x2F;yara-x</a>

YARA-X is dead, long love the next fad