Revision of d561fcadc2627cc3dcb115d18847a236

vee1e revised this gist 2 weeks ago · 513657c

1 file changed, 12 insertions

gsoc-2026-final-submission.md

vee1e revised this gist 2 weeks ago · 4bdcbd9

1 file changed, 1 insertion, 3 deletions

gsoc-2026-final-submission.md

vee1e revised this gist 2 weeks ago · 927aecf

1 file changed, 46 insertions, 46 deletions

gsoc-2026-final-submission.md

Diff is too large to be shown

vee1e revised this gist 2 weeks ago · 5ec2281

1 file changed, 46 insertions, 46 deletions

gsoc-2026-final-submission.md

Diff is too large to be shown

vee1e revised this gist 2 weeks ago · e509e81

1 file changed, 2 insertions, 1 deletion

gsoc-2026-final-submission.md

vee1e revised this gist 2 weeks ago · 48b0538

1 file changed, 48 insertions, 49 deletions

gsoc-2026-final-submission.md

Diff is too large to be shown

vee1e revised this gist 2 weeks ago · 30645b9

1 file changed, 1 insertion, 1 deletion

gsoc-2026-final-submission.md

vee1e revised this gist 2 weeks ago · ccd1e58

1 file changed, 2 insertions, 2 deletions

gsoc-2026-final-submission.md

vee1e revised this gist 2 weeks ago · 6101668

1 file changed, 4 insertions, 7 deletions

gsoc-2026-final-submission.md

Lakshit Verma revised this gist 2 weeks ago · 9c149f8

1 file changed, 1 insertion, 1 deletion

gsoc-2026-final-submission.md

			@@ -16,6 +16,18 @@
16	16
17	17		Repository: [mandiant/flare-floss](https://github.com/mandiant/flare-floss)
18	18
	19	+	## Table of contents
	20	+
	21	+	- [Project overview](#project-overview)
	22	+	- [Project status](#project-status)
	23	+	- [Pre-GSoC work](#pre-gsoc-work)
	24	+	- [Coding-period deliverables](#coding-period-deliverables)
	25	+	- [Timeline of feature work](#timeline-of-feature-work)
	26	+	- [Reviews I contributed](#reviews-i-contributed)
	27	+	- [Future work](#future-work)
	28	+	- [Challenges](#challenges)
	29	+	- [Acknowledgements](#acknowledgements)
	30	+
19	31		## Project overview
20	32
21	33		FLOSS is the FLARE team's command line tool for extracting obfuscated and plaintext strings from malware. An analyst runs it against a binary and gets the readable text the malware uses: URLs, registry paths, API names, and more. That output is useful but bare: it is a flat list of strings with no context.

			@@ -155,15 +155,13 @@ What to do next, roughly in order:
155	155		- Resolve the tracked product decisions. [Viewer tag filtering](https://github.com/mandiant/flare-floss/issues/1377), [version bump and flag aliases](https://github.com/mandiant/flare-floss/issues/1378), and [default deobfuscation behavior](https://github.com/mandiant/flare-floss/issues/1379).
156	156		- Document the new interface. The usage guide does not yet cover the new flags, the summary output, or the cache environment variables.
157	157		- Grow the cache. A v1 tradeoff: no eviction or quota on the cache directory yet, and very large result documents load fully into memory.
158		-	- Move string extraction in-house. The pipeline still leans on lancelot; replacing it with native FLOSS extraction would remove an unmaintained dependency.
159		-	- Widen the viewer's reach. The interactive viewer is CLI-oriented; adding agent-friendly entry points like an llms.txt page would make the tool usable through AI browsing tools.
160	158		- Expand database coverage. More languages and runtime sub-databases (the Go and Rust ones landed) would tighten noise filtering further.
161	159
162	160		None of these block the core functionality. The new pipeline, CLI, and cache are all merged and working.
163	161
164	162		## Challenges
165	163
166		-	The largest single risk was [the big refactor](https://github.com/mandiant/flare-floss/pull/1337). Moving 4,000 lines around risks quietly changing behavior. We addressed it with evidence instead of argument: a parity harness ran old and new code over a thousand random samples, and every output matched. That became the review bar for the rest of the project.
	164	+	The largest single risk was [the big refactor](https://github.com/mandiant/flare-floss/pull/1337) in [#1337](https://github.com/mandiant/flare-floss/pull/1337). Moving 4,000 lines around risks quietly changing behavior. We addressed it with evidence instead of argument: a parity harness ran old and new code over a thousand random samples, and every output matched. That became the review bar for the rest of the project.
167	165
168	166		The planning document was the other hard part. A discussion doc and an implementation spec are different things, and it took a while to realize we needed the latter. Rewriting it as a spec that could be handed to coding agents unblocked the final months of the project. It also became the design reference for the new CLI and the caching module.
169	167

			@@ -73,6 +73,7 @@ FLOSS tags strings by matching them against databases of known library strings.
73	73		- [Database-change diffs](https://github.com/mandiant/flare-floss/pull/1334): a readable text diff of database changes, embedded in the auto-generated PR descriptions.
74	74		- [Workflow dependency fixes](https://github.com/mandiant/flare-floss/pull/1332): dependency and versioning fixes.
75	75		- [Git LFS migration](https://github.com/mandiant/flare-floss/pull/1309): moved the string databases to Git LFS, saving roughly 24 MB per shallow clone.
	76	+	- [OSS DB build CI fix](https://github.com/mandiant/flare-floss/pull/1384): put the repo root on PYTHONPATH so the build script can import the `floss` package in CI.
76	77		- The library list was settled at around 60 open-source libraries, chosen by auditing false-positive rates against a global prevalence database built from 150,000 real-world samples.
77	78
78	79		Building the databases surfaced several bugs in the upstream lancelot project, which the pipeline depends on. I filed reproductions and shipped fixes for all of them:
			@@ -149,7 +150,7 @@ Part of the work was reviewing others. The notable PRs I was asked to review:
149	150
150	151		What to do next, roughly in order:
151	152
152		-	- Rebuild and verify the OSS string databases. QuantumStrand is in master now, so the databases get regenerated and validated against the merged code. A [CI fix for the build workflow](https://github.com/mandiant/flare-floss/pull/1384) is in progress.
	153	+	- Rebuild and verify the OSS string databases. QuantumStrand is in master now, so the databases get regenerated and validated against the merged code, with the [build workflow CI fix](https://github.com/mandiant/flare-floss/pull/1384) merged.
153	154		- Finish the UI release. The web viewer is already deployed at https://mandiant.github.io/flare-floss/ (deployed on every change via the web-release workflow). What remains is serving it from the standalone binary, tracked as an [open issue](https://github.com/mandiant/flare-floss/issues/1371).
154	155		- Resolve the tracked product decisions. [Viewer tag filtering](https://github.com/mandiant/flare-floss/issues/1377), [version bump and flag aliases](https://github.com/mandiant/flare-floss/issues/1378), and [default deobfuscation behavior](https://github.com/mandiant/flare-floss/issues/1379).
155	156		- Document the new interface. The usage guide does not yet cover the new flags, the summary output, or the cache environment variables.

			@@ -28,7 +28,7 @@ This submission is split into two parts. The pre-GSoC work below landed before t
28	28
29	29		## Project status
30	30
31		-	The work is complete. QS was refactored into first-class FLOSS modules, the unified pipeline is the default output path, the new command line is merged, caching ships with the tool, and the web viewer is merged. A source-level review of the merge surfaced ten issues ([#1375](https://github.com/mandiant/flare-floss/issues/1375)), and I fixed the code issues in [#1376](https://github.com/mandiant/flare-floss/pull/1376). QuantumStrand was then merged into master ([#1372](https://github.com/mandiant/flare-floss/pull/1372)), closing the project issue ([#943](https://github.com/mandiant/flare-floss/issues/943)). Three product decisions from the review are still tracked as open issues: the viewer tag filter ([#1377](https://github.com/mandiant/flare-floss/issues/1377)), the version bump and flag aliases ([#1378](https://github.com/mandiant/flare-floss/issues/1378)), and the default deobfuscation behavior ([#1379](https://github.com/mandiant/flare-floss/issues/1379)).
	31	+	The project is fully complete. QS was refactored into first-class FLOSS modules, the unified pipeline is the default output path, the new command line is merged, caching ships with the tool, and the web viewer is merged. A source-level review of the merge surfaced ten issues ([#1375](https://github.com/mandiant/flare-floss/issues/1375)), and I fixed the code issues in [#1376](https://github.com/mandiant/flare-floss/pull/1376). QuantumStrand was then [merged into master](https://github.com/mandiant/flare-floss/pull/1372), [closing the project issue](https://github.com/mandiant/flare-floss/issues/943). Three product decisions from the review are still tracked as open issues: the viewer tag filter ([#1377](https://github.com/mandiant/flare-floss/issues/1377)), the version bump and flag aliases ([#1378](https://github.com/mandiant/flare-floss/issues/1378)), and the default deobfuscation behavior ([#1379](https://github.com/mandiant/flare-floss/issues/1379)).
32	32
33	33		## Pre-GSoC work
34	34

			@@ -150,8 +150,8 @@ Part of the work was reviewing others. The notable PRs I was asked to review:
150	150
151	151		What to do next, roughly in order:
152	152
153		-	- Rebuild and verify the OSS string databases. QuantumStrand is in master now, so the databases get regenerated and validated against the merged code.
154		-	- Automate the UI release. A GitHub Actions workflow that deploys the web viewer whenever it changes, and bundles the viewer into the FLOSS binary with PyInstaller.
	153	+	- Rebuild and verify the OSS string databases. QuantumStrand is in master now, so the databases get regenerated and validated against the merged code. A CI fix for the build workflow is in [#1384](https://github.com/mandiant/flare-floss/pull/1384).
	154	+	- Finish the UI release. The web viewer is already deployed at https://mandiant.github.io/flare-floss/ (deployed on every change via the web-release workflow). What remains is serving it from the standalone binary: the PyInstaller bundling is tracked in [#1371](https://github.com/mandiant/flare-floss/issues/1371).
155	155		- Resolve the tracked product decisions. Viewer tag filtering ([#1377](https://github.com/mandiant/flare-floss/issues/1377)), version bump and `--only`/`--no` aliases ([#1378](https://github.com/mandiant/flare-floss/issues/1378)), and default deobfuscation behavior ([#1379](https://github.com/mandiant/flare-floss/issues/1379)).
156	156		- Document the new interface. The usage guide does not yet cover the new flags, the summary output, or the cache environment variables.
157	157		- Grow the cache. A v1 tradeoff: no eviction or quota on the cache directory yet, and very large result documents load fully into memory.

			@@ -28,7 +28,7 @@ This submission is split into two parts. The pre-GSoC work below landed before t
28	28
29	29		## Project status
30	30
31		-	The work is essentially complete. QS was refactored into first-class FLOSS modules, the unified pipeline is the default output path, the new command line is merged, caching ships with the tool, and the web viewer is merged. The final step is the merge of the QuantumStrand branch into master. The remaining product decisions are tracked as issues I opened: the [viewer tag filter in #1377](https://github.com/mandiant/flare-floss/issues/1377), the [version bump and flag aliases in #1378](https://github.com/mandiant/flare-floss/issues/1378), and the [default deobfuscation behavior in #1379](https://github.com/mandiant/flare-floss/issues/1379).
	31	+	The work is complete. QS was refactored into first-class FLOSS modules, the unified pipeline is the default output path, the new command line is merged, caching ships with the tool, and the web viewer is merged. A source-level review of the merge surfaced ten issues ([#1375](https://github.com/mandiant/flare-floss/issues/1375)), and I fixed the code issues in [#1376](https://github.com/mandiant/flare-floss/pull/1376). QuantumStrand was then merged into master ([#1372](https://github.com/mandiant/flare-floss/pull/1372)), closing the project issue ([#943](https://github.com/mandiant/flare-floss/issues/943)). Three product decisions from the review are still tracked as open issues: the viewer tag filter ([#1377](https://github.com/mandiant/flare-floss/issues/1377)), the version bump and flag aliases ([#1378](https://github.com/mandiant/flare-floss/issues/1378)), and the default deobfuscation behavior ([#1379](https://github.com/mandiant/flare-floss/issues/1379)).
32	32
33	33		## Pre-GSoC work
34	34
			@@ -150,12 +150,9 @@ Part of the work was reviewing others. The notable PRs I was asked to review:
150	150
151	151		What to do next, roughly in order:
152	152
153		-	- Finish the merge of QuantumStrand into master. [#1372](https://github.com/mandiant/flare-floss/pull/1372) is open. A review of it filed ten issues ([#1375](https://github.com/mandiant/flare-floss/issues/1375)); six are fixed in [#1376](https://github.com/mandiant/flare-floss/pull/1376). The rest need product decisions I tracked as issues:
154		-	- Viewer tag filtering ([#1377](https://github.com/mandiant/flare-floss/issues/1377))
155		-	- Version bump and `--only`/`--no` aliases ([#1378](https://github.com/mandiant/flare-floss/issues/1378))
156		-	- Default deobfuscation behavior ([#1379](https://github.com/mandiant/flare-floss/issues/1379))
157		-
158		-	- Ship the web viewer. Decide how it distributes: inside the released binary, served from the tool, or as a standalone site. Add a deploy workflow so it updates automatically.
	153	+	- Rebuild and verify the OSS string databases. QuantumStrand is in master now, so the databases get regenerated and validated against the merged code.
	154	+	- Automate the UI release. A GitHub Actions workflow that deploys the web viewer whenever it changes, and bundles the viewer into the FLOSS binary with PyInstaller.
	155	+	- Resolve the tracked product decisions. Viewer tag filtering ([#1377](https://github.com/mandiant/flare-floss/issues/1377)), version bump and `--only`/`--no` aliases ([#1378](https://github.com/mandiant/flare-floss/issues/1378)), and default deobfuscation behavior ([#1379](https://github.com/mandiant/flare-floss/issues/1379)).
159	156		- Document the new interface. The usage guide does not yet cover the new flags, the summary output, or the cache environment variables.
160	157		- Grow the cache. A v1 tradeoff: no eviction or quota on the cache directory yet, and very large result documents load fully into memory.
161	158		- Move string extraction in-house. The pipeline still leans on lancelot; replacing it with native FLOSS extraction would remove an unmaintained dependency.