<div dir="ltr">The other question I was wondering about is: should this be a BIF? Software::parse is a rather lengthy function, with a lot of string manipulation, which gets called rather frequently. I suspect there'd be some performance improvements for implementing this directly as a BIF.</div><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Dec 14, 2015 at 3:24 PM, Seth Hall <span dir="ltr"><<a href="mailto:seth@icir.org" target="_blank">seth@icir.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class=""><br>
> On Dec 14, 2015, at 10:51 AM, Vlad Grigorescu <<a href="mailto:vlad@grigorescu.org">vlad@grigorescu.org</a>> wrote:<br>
><br>
> I'm not thrilled with those user agents are being handled right now, and I'm curious to get some thoughts. Take, for example the Safari user-agent string of:<br>
<br>
</span>I think your proposal sounds reasonable. I’d go ahead and implement it and see what you think about overload situations since I can easily see the amount of software being tracked quickly get out of hand with that. After it’s implemented, get it running on several networks that are willing to run it and see if it causes problems for them. :)<br>
<br>
This could be a good time to also implement some better handling around software tracking to avoid obvious DoS issues by doing traffic that causes lots of state being tracked.<br>
<br>
.Seth<br>
<br>
--<br>
Seth Hall<br>
International Computer Science Institute<br>
(Bro) because everyone has a network<br>
<a href="http://www.bro.org/" rel="noreferrer" target="_blank">http://www.bro.org/</a><br>
<br>
</blockquote></div><br></div>