[Bro-Dev] Opinions on trace rewriter?

[Adam J. Slagell]

On Oct 25, 2010, at 12:41 PM, Robin Sommer wrote:

> We could do a compromise: Remove it, but turn all the code into a
> big patch that applies cleanly to the next release. We wouldn't fix
> anything for now, and we wouldn't maintain the patch for future
> releases, but we'll keep the patch around if somebody comes along
> who has an interest in doing (b) (which might just as well by
> ourselves if at some point we want to spend our resources on that; I
> don't see that near-term though). 

Not sure what I am stepping into, but here I go. I agree strongly with Robin. It seems if it is broken now, then you don't really have a user community that you would disappoint. I don't see that (b) was really in line with any proposed work in the latest grant and would likely need a champion with funding to lead the effort to resurrect it. If the only reason to keep it is to show what can be done with Bro, the papers already do that and a broken piece of software doesn't help anyway.

------
Adam J. Slagell, CISSP
Sr. Security Engineer
National Center for Supercomputing Applications
University of Illinois at Urbana-Champaign
www.slagell.info
217.244.8965