[Snort-sigs] Community Rule Update
alex.kirk at ...435...
Mon Apr 4 08:07:26 EDT 2005
Glad to know such a flag exists -- it definitely shows foresight on your
part. That said, I think you've made my point for me when you say "I'm
not sure anyone is actually using it" -- it sounds like a lot of
people's installations would break if we introduced a new variable with
little to no warning. Besides, as great as Oinkmaster is, there are
plenty of people who use other rule updaters that may not have such an
intelligent feature. :-)
I think this is where the OSSRC may come in handy (once it's up and
operational, anyway) -- if there seems to be a need for new variables,
particularly across a large number of rules, we could all agree on what
those variables should be, give the community ample warning about their
introduction, and then be around to help the people who will invariably
pop up and say "Hey, you broke my Snort!" when the variable is actually
For now, though, I think it makes sense to err on the side of not
breaking a large number of installations, especially if the note about
using a variable is included in the documentation for anyone who wants
to tweak the rule.
Community Rules Maintainer
>On Monday 04 April 2005 15:11, Alex Kirk wrote:
>>As to the idea of a VALID_PROXY_SERVERS variable, it makes sense -- *if*
>>you've gone through as an admin and defined that variable. The problem
>>is, for people who are just letting Oinkmaster grab new rules without
>>touching their conf, this rule would break Snort, since they wouldn't
>>have that variable defined. That said, though, it's a good way to cut
>>down false positives if you take the time to define the variable, so
>>I'll add your suggestion to the doc.
>>Community Rules Maintainer
>That's exactly what the -U flag in Oinkmaster is there for, i.e. merge new
>variables into your local snort.conf so Snort doesn't break when there are
>new variables introduced in the downloaded rules.
>I'm not sure anyone is actually using it, but it's there :)
>SF email is sponsored by - The IT Product Guide
>Read honest & candid reviews on hundreds of IT Products from real users.
>Discover which products truly live up to the hype. Start reading now.
>Snort-sigs mailing list
>Snort-sigs at lists.sourceforge.net
More information about the Snort-sigs