regarding mechanism , policy.

[Ashley Thomas]

hi,

It is very advantageous to have mechanism and policy separated
(as mentioned in Bro paper) but does it incur any overhead ?

The paper says: for each event passed to the interpreter,
it retrieves the (semi-) compiled code for the corresponding handler,
binds the values of the events to the arguments of the handler, and
interprets the code.

Would'nt this take some extra time compared to if it was already compiled?
(although the flexibility is lost in the latter case)


thanks a lot
Ashley