[Snort-sigs] Any reason for "nocase;" in web-attacks.rules?

[Crow, Owen]

Almost all of the rules in the file appear to be targeted at Unix systems,
but every rule has "nocase;".  For example:

alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-ATTACKS ps command
attempt"; flags:A+; uricontent:"/bin/ps"; nocase;
classtype:web-application-attack; sid:1328; rev:2;)

The only situation where nocase would help would be a Win32 target with
Cygwin installed.  So removing nocase should speed up the comparisons and
eliminate false positives, right?

Regards,
Owen Crow
Systems Programmer (Unix)
BMC Software, Inc.