Re: Funny note here on a worm

[Jason <security () brvenik com>]

Ron Gula wrote:
> At 07:10 AM 5/1/2005, Kyle Quest wrote:
>
> > The idea to release this advisory obviously came
> > from the marketing guys from Sourcefire. The snort.org
> > website became a marketing and a sales tool for Sourcefire.
> > Snort itself is changing too. Look at what's going on
> > with the rules... This is just sad.
>
>
> My only criticism of the sig was that it has known false
> positive, right out of the box:

*nod*

A preprocessor has been released since to provide faster detection 
without the false positive potential. As I understand it, this is one of 
the rare cases where it did not make sense to do the detection with rules.
_______________________________________________
Dailydave mailing list
Dailydave () lists immunitysec com
https://lists.immunitysec.com/mailman/listinfo/dailydave