[Bro-Dev] Opinions on trace rewriter?
Robin Sommer
robin at icir.org
Mon Oct 25 08:49:17 PDT 2010
What are the opinions on completely removing the trace rewriter from
the Bro code base? I think I vaguely remember us discussing this,
with a conclusion that removing is the way to go, but I wanted to
check.
Pros of removing:
- Rewriter is broken right now anyway
- Not used by many people (just the "occasional researcher" :-)
- Nobody knows the internals well.
- It's quite intrusive to the code, and removing it will get rid of
quite a bit of stuff sprinkled across the source.
Cons:
- It's pretty cool functionality and nobody else has it.
I really like the rewriting but I'm thinking it would be better done
in an external tool than inside Bro itself.
Robin
--
Robin Sommer * Phone +1 (510) 722-6541 * robin at icir.org
ICSI/LBNL * Fax +1 (510) 666-2956 * www.icir.org
More information about the bro-dev
mailing list