[Bro-Dev] CBAN naming

Slagell, Adam J slagell at illinois.edu
Fri Jun 3 12:39:15 PDT 2016

> On Jun 3, 2016, at 1:59 PM, Siwek, Jon <jsiwek at illinois.edu> wrote:
>> On Jun 2, 2016, at 3:13 PM, Slagell, Adam J <slagell at illinois.edu> wrote:
>> It looks like that term is just used here for “Script packages” and on all the auto generated subpages. We can just rename that as I don’t it is not a widely used term. I do want to do that before 2.5 if we do it, though.
>> So with that said, I propose bro-pkg, but will leave this open for another day if there are strong opinions.
> Collections of bro scripts in a directory containing an __load__.bro file were named “packages” because that is pretty much the same way Python structures the things it calls “packages”.  So, now that I think about it, it’s actually more odd to rename them because that structural similarity is not going away.
> Maybe I value consistency too much, but I don’t see how any of the proposals so far are improvements to the current situation.  I’m going to make a final argument for just sticking with the original names of things:
> 1) Keep calling “Bro Script Packages” as “packages”.  They look just like Python packages after all.
> 2) Keep calling “Bro Plugins” as “plugins”.  No one explicitly asked to rename plugins or give them an alternate name, but that is what is happening here whether people realized it or not.  Why are we trying to create a synonym for something that is already called a “plugin” ?  Won’t it be more confusing if it turns out that a “package” may also be called a “plugin” ?  And confusing that a “package" (also called a “plugin”) shares little similarity with a Python package, but it contains within it something that does look like a Python package, yet is named something else?
> 3) CBAN becomes something like “Bro Plugin Manager” because it is dealing with plugins, not packages.  In fact, “plugin" is probably more descriptive about what is going on. In general, a plugin just means any form of extending a software’s functionality without having to directly modify that software.  That could mean shared libraries, scripts, etc.  This is exactly what is going on here and I don’t see how we can get any more clear or consistent than the existing names.

So what would you do, call it the tool bro-bpm, the project “Bro Plugin Manager” (BPM), and the objects being managed plugins? 

Alternatively, what I earlier proposed is that we call directories of related scripts bundles, plugins are called plugins, a plugin+metadata that fits them within our package manager a package, and the whole system the Bro Package Manager (BPM) with the tool named bro-pkg.

I am fine if we want to hash out these last two options a bit longer, but please no more to the mix.


Adam J. Slagell
Chief Information Security Officer
Director, Cybersecurity Division
National Center for Supercomputing Applications
University of Illinois at Urbana-Champaign

"Under the Illinois Freedom of Information Act (FOIA), any written communication to or from University employees regarding University business is a public record and may be subject to public disclosure." 

More information about the bro-dev mailing list