[Snort-sigs] Community Rule Update

Alex Kirk alex.kirk at ...435...
Mon Apr 4 08:07:26 EDT 2005


Andreas,

Glad to know such a flag exists -- it definitely shows foresight on your 
part. That said, I think you've made my point for me when you say "I'm 
not sure anyone is actually using it" -- it sounds like a lot of 
people's installations would break if we introduced a new variable with 
little to no warning. Besides, as great as Oinkmaster is, there are 
plenty of people who use other rule updaters that may not have such an 
intelligent feature. :-)

I think this is where the OSSRC may come in handy (once it's up and 
operational, anyway) -- if there seems to be a need for new variables, 
particularly across a large number of rules, we could all agree on what 
those variables should be, give the community ample warning about their 
introduction, and then be around to help the people who will invariably 
pop up and say "Hey, you broke my Snort!" when the variable is actually 
introduced.

For now, though, I think it makes sense to err on the side of not 
breaking a large number of installations, especially if the note about 
using a variable is included in the documentation for anyone who wants 
to tweak the rule.

Alex Kirk
Research Analyst/
Community Rules Maintainer
Sourcefire, Inc.

>On Monday 04 April 2005 15:11, Alex Kirk wrote:
>  
>
>>As to the idea of a VALID_PROXY_SERVERS variable, it makes sense -- *if*
>>you've gone through as an admin and defined that variable. The problem
>>is, for people who are just letting Oinkmaster grab new rules without
>>touching their conf, this rule would break Snort, since they wouldn't
>>have that variable defined. That said, though, it's a good way to cut
>>down false positives if you take the time to define the variable, so
>>I'll add your suggestion to the doc.
>>
>>Alex Kirk
>>Research Analyst/
>>Community Rules Maintainer
>>Sourcefire, Inc.
>>    
>>
>
>That's exactly what the -U flag in Oinkmaster is there for, i.e. merge new 
>variables into your local snort.conf so Snort doesn't break when there are 
>new variables introduced in the downloaded rules.
>I'm not sure anyone is actually using it, but it's there :)
>
>/Andreas
>
>
>-------------------------------------------------------
>SF email is sponsored by - The IT Product Guide
>Read honest & candid reviews on hundreds of IT Products from real users.
>Discover which products truly live up to the hype. Start reading now.
>http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
>_______________________________________________
>Snort-sigs mailing list
>Snort-sigs at lists.sourceforge.net
>https://lists.sourceforge.net/lists/listinfo/snort-sigs
>  
>





More information about the Snort-sigs mailing list