<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body>
<div>
<div style="font-family: Calibri,sans-serif; font-size: 11pt;">That was before the official release of snort 2.9.7.0. The .so rules now ship with the rules tarball and should work as usual.<br>
<br>
YM<br>
<br>
Sent from Mobile</div>
</div>
<div dir="ltr">
<hr>
<span style="font-family: Calibri,sans-serif; font-size: 11pt; font-weight: bold;">From:
</span><span style="font-family: Calibri,sans-serif; font-size: 11pt;"><a href="mailto:secaficionado@...8...">Sec_Aficionado</a></span><br>
<span style="font-family: Calibri,sans-serif; font-size: 11pt; font-weight: bold;">Sent:
</span><span style="font-family: Calibri,sans-serif; font-size: 11pt;">‎11/‎2/‎2014 12:35 AM</span><br>
<span style="font-family: Calibri,sans-serif; font-size: 11pt; font-weight: bold;">To:
</span><span style="font-family: Calibri,sans-serif; font-size: 11pt;"><a href="mailto:Snort-openappid@lists.sourceforge.net">Snort-openappid@...51...s.sourceforge.net</a></span><br>
<span style="font-family: Calibri,sans-serif; font-size: 11pt; font-weight: bold;">Subject:
</span><span style="font-family: Calibri,sans-serif; font-size: 11pt;">[Snort-openappid] OppenAppID and Shared Object Rules</span><br>
<br>
</div>
<div class="BodyFragment">
<div class="PlainText">Hello,<br>
<br>
In the snort blog entry titled "Firing up  OpenAppID", the author recommends  disabling the SO rules. There wasn't a 2.9.7.0 specific rule at the time "so it's easier to skip this for now", he said.<br>
<br>
Is that still the case?<br>
<br>
Are there any special considerations?<br>
<br>
Thanks in advance.<br>
<br>
SecAficionado<br>
------------------------------------------------------------------------------<br>
_______________________________________________<br>
Snort-openappid mailing list<br>
Snort-openappid@lists.sourceforge.net<br>
<a href="https://lists.sourceforge.net/lists/listinfo/snort-openappid">https://lists.sourceforge.net/lists/listinfo/snort-openappid</a><br>
<br>
Please visit <a href="http://blog.snort.org">http://blog.snort.org</a> to stay current on all the latest Snort news!<br>
</div>
</div>
</body>
</html>