[Bro-Dev] [JIRA] (BIT-1405) Notice framework documentation confusion

[Vern Paxson (JIRA)]

     [ https://bro-tracker.atlassian.net/browse/BIT-1405?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Vern Paxson updated BIT-1405:
-----------------------------
    Description: The [Notice documentation|https://www.bro.org/sphinx/frameworks/notice.html] includes the phrase "_Users should directly make modifications to the Notice::Info record given as the argument to the hook_".  Initially I read this with a presumption that it was a typo and what was meant was instead "should *not* directly make ...".  Then when I got to the example I see that it actually does mean go-ahead-and-modify, though presumably it only makes sense to modify some fields (such as $actions) and not others (context provided by the Info record).  So this phrasing should be clarified, maybe along the lines of "Users alter notice processing by directly modifying certain fields in the Notice::Info record given as the argument ...".  (was: The [Notice documentation|https://www.bro.org/sphinx/frameworks/notice.html] includes the phrase "_Users should directly make modifications to the Notice::Info record given as the argument to the hook_".  Presumably this is instead "should *not* directly make ...")
        Summary: Notice framework documentation confusion  (was: Notice framework documentation glitch)

> Notice framework documentation confusion
> ----------------------------------------
>
>                 Key: BIT-1405
>                 URL: https://bro-tracker.atlassian.net/browse/BIT-1405
>             Project: Bro Issue Tracker
>          Issue Type: Problem
>          Components: Documentation
>            Reporter: Vern Paxson
>            Priority: Low
>
> The [Notice documentation|https://www.bro.org/sphinx/frameworks/notice.html] includes the phrase "_Users should directly make modifications to the Notice::Info record given as the argument to the hook_".  Initially I read this with a presumption that it was a typo and what was meant was instead "should *not* directly make ...".  Then when I got to the example I see that it actually does mean go-ahead-and-modify, though presumably it only makes sense to modify some fields (such as $actions) and not others (context provided by the Info record).  So this phrasing should be clarified, maybe along the lines of "Users alter notice processing by directly modifying certain fields in the Notice::Info record given as the argument ...".



--
This message was sent by Atlassian JIRA
(v6.5-OD-04-052#65000)