[Bro-Dev] Opinions on trace rewriter?

Robin Sommer robin at icir.org
Mon Oct 25 08:49:17 PDT 2010


What are the opinions on completely removing the trace rewriter from
the Bro code base? I think I vaguely remember us discussing this,
with a conclusion that removing is the way to go, but I wanted to
check.

Pros of removing:

- Rewriter is broken right now anyway 

- Not used by many people (just the "occasional researcher" :-)

- Nobody knows the internals well.

- It's quite intrusive to the code, and removing it will get rid of
quite a bit of stuff sprinkled across the source. 

Cons:

- It's pretty cool functionality and nobody else has it. 


I really like the rewriting but I'm thinking it would be better done
in an external tool than inside Bro itself. 

Robin

-- 
Robin Sommer * Phone +1 (510) 722-6541 * robin at icir.org 
ICSI/LBNL    * Fax   +1 (510) 666-2956 *   www.icir.org



More information about the bro-dev mailing list