-----BEGIN PGP SIGNED MESSAGE-----
Hash: RIPEMD160
hi chris,
Chris Santerre wrote, On 8/11/06 9:26 AM:
>> from a user's perspective, all this is confusing/confounding. as a
>> user, i want to see/use one mechanism for rules.
>
> From an SA admin, it makes perfect sense. :)
well, given that i'm admin numerous SA-installs as well, and was simply
opining as a user, i'll politely & adamantly disagree with you :-)
and, it would seem, both some other admins and sa-devs do as well ... to
be fair, others agree with you.
>> currently, it all "smells" like a bunch o' (talented & well-meaning)
>> engineers discussing how NOT to do things, and WHETHER to do things.
>> and, a fair dosage of 'project pride' mixed in ...
>
> A little from column A and B. But there are some good reasons to why they
> are seperate.
i'm not arguing the reasons. i'm opining about the (my) end-users
perspective.
since i'm 'spending' my $0.01 anyway, that opinion is (where ARE those
asbestos shorts ?!) that "i don't care about the reasons".
>> iiuc, SARE, & eventually RDJ, were created a while ago because,
>> historically , releasing new sa-project rules
>>
>
> You kind of trailed off there :)
(damn copy-n-paste ...)
> "... releasing new sa-project rules" ...
... required an SA-code release which was an unacceptably slow process
>> quite clearly, with the advent of SA-project released/blessed
>> sa-update,
>> it's not really necessary anymore. i.e., asynchronous rule & code
>> releases are provided for.
>
> Ok, no. SARE and the official SA are worlds apart. SARE has been setup
to be
> QUICK and accurate. SA is accurate. SARE wants to get good rules out when
> they are needed. Now saupdate make the DELIVERY of that possible.
fine. point made re: the CREATION of rules.
i agree that multiples sources of rules are a good thing ... just like
multiple DNSBL/RBS sources are.
but, using that example, there's a "standard way" for getting at those
multiple sources ... THAT's what i think needs to be fixed here.
to your point, it's abt the delivery.
> But the creation of rules in the official method of SA is... please
pardon me... a
> clusterfsck!
if true -- and i'll assume so for the sake of discussion here -- then,
in the immortal words of "Tim Gunn", then collaborate & "Make it work!"
> And the apache lic is like reading the fine print on a life insurance
> policy. I've looked into what it would take to make SARE a part of SA
> officialy. Yeah, I'll pass.
from your perspective, certainly valid.
from a user's, again - don't care.
> The ability for SARE to get good rules out fast is why it is there.
<snip>
again, not arguing about an asynchronously developed, fast & accurate,
*source* of rules. the more the merrier.
i'm ranting about the functional "getting them" part.
thanks for the comments!
- --
/"\
\ / ASCII Ribbon Campaign
X against HTML email, vCards
/ \ & micro$oft attachments
[GPG] OpenMacNews at gmail dot com
fingerprint: 50C9 1C46 2F8F DE42 2EDB D460 95F7 DDBD 3671 08C6
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (Darwin)
iEYEAREDAAYFAkTcssoACgkQlffdvTZxCMbuhACdEFDgb+/4gs0Ds/ROT/5tc6S/
rgMAmgPUrKWCqiKxXM5JW5VSHoQM0vXx
=h/Lf
-----END PGP SIGNATURE-----
