Re: [Snort-sigs] Rule Set Completness

On Tue, 2006-05-09 at 11:36 -0400, Matt Jonkman wrote:
> > see also: OSSRC Rules Overlap Committee.

> There are some dupes now. We are trying to work them out with the SF
> folks via the overlap committee. It's slow at the moment. That committee
> is just getting it's legs, and has a lot of work ahead of it. But have
> faith, I know they'll get into motion soon!

Is it? The last email in the ossrc list was from me back in September of
last year. Looks to me like OSSRC curled up and died. Especially
considering the recent rash of duplicate signatures put forth by the SF
guys in regards to malware/spyware sigs and little sigs like Nugache.

I have the impression that no one cares anymore about avoiding
duplicates. Then again, licensed VRT sigs were excluded from that
anyway.

And I have yet to see anything in regards to the SID allocation project
either. Perhaps we need to start a small SID allocation database at
BleedingSnort. Shouldn't take more than a couple days to set up.

Cheers,
Frank


-- 
It is said that the Internet is a public utility. As such, it is best
compared to a sewer. A big, fat pipe with a bunch of crap sloshing
against your ports.

signature.asc
Description: This is a digitally signed message part