Andreas,
Glad to know such a flag exists -- it definitely shows foresight on your
part. That said, I think you've made my point for me when you say "I'm
not sure anyone is actually using it" -- it sounds like a lot of
people's installations would break if we introduced a new variable with
little to no warning. Besides, as great as Oinkmaster is, there are
plenty of people who use other rule updaters that may not have such an
intelligent feature. :-)
I think this is where the OSSRC may come in handy (once it's up and
operational, anyway) -- if there seems to be a need for new variables,
particularly across a large number of rules, we could all agree on what
those variables should be, give the community ample warning about their
introduction, and then be around to help the people who will invariably
pop up and say "Hey, you broke my Snort!" when the variable is actually
introduced.
For now, though, I think it makes sense to err on the side of not
breaking a large number of installations, especially if the note about
using a variable is included in the documentation for anyone who wants
to tweak the rule.
Alex Kirk
Research Analyst/
Community Rules Maintainer
Sourcefire, Inc.
On Monday 04 April 2005 15:11, Alex Kirk wrote:
As to the idea of a VALID_PROXY_SERVERS variable, it makes sense -- *if*
you've gone through as an admin and defined that variable. The problem
is, for people who are just letting Oinkmaster grab new rules without
touching their conf, this rule would break Snort, since they wouldn't
have that variable defined. That said, though, it's a good way to cut
down false positives if you take the time to define the variable, so
I'll add your suggestion to the doc.
Alex Kirk
Research Analyst/
Community Rules Maintainer
Sourcefire, Inc.
That's exactly what the -U flag in Oinkmaster is there for, i.e. merge new
variables into your local snort.conf so Snort doesn't break when there are
new variables introduced in the downloaded rules.
I'm not sure anyone is actually using it, but it's there :)
/Andreas
-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
