Re: New rules keyword error

[Frank Knobbe <frank () knobbe us>]

On Thu, 2003-10-23 at 08:57, Marc Quibell wrote:
> -I have always Auto-updated Snort. Period.  Never had any problems.

Oh really? You didn't run into problems during the 1.9/2.0 parallel? I
remember that CVS all of the sudden contained rules with strange new
keywords, and Snort barfed promptly. The solution was obviously to check
out the correct tag and not rely on HEAD. Maybe you got lucky with
tarballs, but I recall there being with those in the past as well.

> -I don't pay for this product, it's not a production show-stopper! So no one is
> going to fuss about it, or even notice it, if it's out of comminsion for 5 mins
> or 5 days!

That may be, but that's only you. Don't assume the same for others.

> Now, why on Earth would I babysit this product? I can usually fix any problem
> with rules in a matter of seconds...

Maybe I'm missing context, but IDS's need to be babysit. If you don't,
there may be something wrong with the way to do IDS.

No offense, just some food for thought....

Regards,
Frank

Attachment: signature.asc
Description: This is a digitally signed message part