[Snort-users] snort rules

Paul Schmehl pauls at ...6838...
Thu Apr 28 16:04:50 EDT 2005


--On Thursday, April 28, 2005 06:01:01 PM -0400 Matt Kettler 
<mkettler at ...4108...> wrote:
>
> You only have to pay to get the rules written by sourcefire's VRT group
> in a timely fashion. You can get them for free with a 5 day delay.
>
> Community written rules are also still freely updated on a timely basis.
>
The more I think about this, the more I like it.  The only people this 
change penalizes are vendors who *used* to "steal" snort without giving 
Sourcefire and Marty any credit and who want to convince their customers 
that they *always* have the latest and greatest rules (so they can't afford 
to wait the five days.)  And that's exactly why this change was made.

The average schmoo like me can get their rules from anywhere or write their 
own.  And five days after the "big boys" get theirs, I have the *same* 
rules they do.

Seems like a win-win to me.

Paul Schmehl (pauls at ...6838...)
Adjunct Information Security Officer
The University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu




More information about the Snort-users mailing list