Re: [Snort-sigs] OSSRC Rules Overlap Committee

Blake Hartstein wrote:
> Of course the default options could still be allowed, but this would
> certainly solve the problems of allowing multiple people to
> independently manage their own sids.

The "Problem With The Rulesets" is not that the sid's clash, but that the
intent of the rules themselves clash!   That's what needs to be fully
addressed, how to deal with precedence issues, and how to deal with rules
of similar but unequal intent, or similar but unequal performance.

The majority of the issue is the overlap in detection coverage between
the groups, though, and there needs to be a way to express which ones
you, the user, prefer so that you don't end up with twenty copies of
the same signature.



-- 
Erik Fichtner; Unix Ronin

"Mathematics is something best shared between consenting adults
in the privacy of their own office" - Adam O'Donnell

signature.asc
Description: OpenPGP digital signature