[Snort-users] newbie type questions

J.C. Woods cwoods at ...5405...
Tue Jun 24 05:21:47 EDT 2003

Rich Adamson wrote:

>>Ok, I'm teetering on the brink of a rant, but I'm going to try to come
>>back from the edge--And no, it's not at anyone in particular....
>>Check the FAQ [0], the ACID FAQ [1], and the archives [2].  It's been
>>spelled out there more times than I would care to count.
>Been a fair amount of discussion on the list in terms of new users asking
>repetitive questions, however keep in mind not a single one of them have
>a clue they are repeating previously asked questions, and its not all that 
>obvious where the two-hour-old user should be looking for answers.
>Example: look around the www.snort.org home page and see if there is anything
>that you can easily spot that would suggest a reasonable way to research
>a typical question. Down the left side is "News", "Documentation", "Downloads"
>and "Mailing lists". Guess which one of those happens to be the first thing
>that a new user recognizes!! (Its the one right after documentation, and 
>they don't need to read that as yet since snort and a favorite add-on is not
>running. Think about that for just a second. Those that have been involved
>with any form of marketing know where the eye focuses on that first page.)
>2nd Example: check the FAQ... what does it suggest for help?  Question 1.3
>says "use the mailing list". If one searches the FAQ for mailing list 
>archives, it doesn't exist. Maybe that should be FAQ 1.1.5, or 1.3 reworded 
>to cover the aggressive (but nicely worded) references that have been going 
>on for some time.
>3rd Example: if one finally recognizes that a mailing list archive even
>exists (at another site), that site _implies_ the search has to be done by
>month (even though most of us know that's not the case). 
>I'd suggest the maintainers of the www.snort.org page could do a _lot_ more
>to help point out what is considered appropriate research behavior, even for
>newbies. How about something as simple as a bold statement at the top of the
>home page that says...
>"You've got questions, we've got answers... most have already been asked,
>click here!" An common search example might even be beneficial. (The News can 
>always follow by at least one line!)
>long time reader and user (not a newbie)
What's this? A response replete with reasoning, logic, and positive directions for a possible correction to a perennial problem. You mean you did not want to simply emote about this issue so that it could continue into perpetuity? Well all I can say, Rich, is that you have done a nice job with your suggestions on this obviously vexing problem, and I concur with your assessment.

Also signed,
long time reader and user

J. Craig Woods
UNIX Network/System Engineer
Let him that would move the world, first move himself.
-- Socrates

More information about the Snort-users mailing list