[Snort-users] List

Joe McAlerney joey at ...47...
Wed Mar 13 17:04:06 EST 2002


Mike Poor wrote:

> I am aware of the work that Silicon Defense has undertaken with regards to
> Snort, and was surprised when M. Steeles tone seemed more like a sales rep
> then someone trying to help out a fellow snorter.  I think that the folks
> over at snort.org have done a good job (still a learning process of course)
> at rearing the project and will continue to do so.  I know that Marty has
> always been concerned with the portablity of Snort, and snort users should
> know that they can count on finding appropriate source files, binaries,
> packages, and documentation right here, on snort..org.

As you might imagine, that "tone" is being addressed (even more) in
light of current events. *ugh..*

The guys at Snort.org have done a tremendous amount of quality work for
the public, and continue to do so.  There is no doubt about that, and
you won't find one person who agrees otherwise.  Back when the world was
bright, shiny and new we threw ideas around on the devel list and worked
on ways to get our research into Snort for the community to use, why? 
Well because it's much more enjoyable to get a compliment from a user
than a dollar from a customer.  I'm sad to see things turn sour over
miscommunication.
 
> On Wednesday 13 March 2002 07:00 pm, Joe McAlerney enlightened us with:
> 
> "The tricky part for us is to help people without it looking self
> serving.  If Mike Steele points Windows user Bill to his documentation,
> it comes across far worse then if some other random person did.  This is
> why we're trying to get the docs up on Snort.org, so we can link there.
> Mike gets these kinds of questions literally a dozen times a week, and
> most always it is answered "in the documentation".  "
> 
> he gets these requests dozens of times a week?  I dont see a problem of him
> responding to people on your own list (if that is what you are referring to),
> and telling them to rtfm or whatever it is that he is replying... that is on
> your list, and your domain.  Now, answering requests for help from the
> snort-users list with : go to our site, download our documentation, not that
> stuff from snort.org... would be similar to someone asking a question about
> snort and one of the sourcefire guys saying... try out one of our sensors...
> go to our site and view our screenshots ... dl a brochure, and by the way our
> product does bla bla bla.. there is no place for that on this list.

Yes he does.  The guy can't get his work done, so he has to reply at
home.  That's dedication, and it's sad to see him put in such an awkward
position.  Mike S. is probably one of the most non-threatening guys I
know, and an hour in the room with him would show anyone that.  I agree
for the most part with the second scenario you painted.  If you mull
through the e-mails, you'll see examples of us responding to these types
of questions regardless of which installer they used (who cares
right?).  Mike's comment came across bad, because he was speaking with
what he's familiar with.  This should be obvious to everybody in
retrospect.  However, he's not sending people to a product.  He's
sending them straight to the documentation where no mention of our
products exists.  You certainly won't find any one of us mentioning our
products on the list unless someone asks "What commercial products are
available for Snort?".  It doesn't really occur too often anyway.  When
this did occur, notice that we followed up another post by directing the
poster to other vendors in competition with ourselves.  That should be
the nature of the list don't you agree?  Personally, I would like it a
snort-commercial list was created for things like that.

> We all owe, Stewart and crew included, a big enormous thanks to Marty Roesch,
> regardless of how much work and effort we have or have not put into the Snort
> project.

We have and will continue doing this.  This is sort of what I am
interested in.  What does it take to show appreciation?  Should showing
appreciation somehow nullify any concerns someone has?

> 
> Marty, thanks.

sqrt(ditto)
 
> Mike Poor

-Joe M.

-- 
Joe McAlerney
Software Developer / Security Consultant
joey at ...47...
Silicon Defense: IDS Solutions -=- http://www.silicondefense.com/




More information about the Snort-users mailing list