Re: sa-update versus rulesdujour questions

2006-10-20 Thread Chris Thielen
Jo Rhett wrote: Is there any difference here that I'm overlooking? Any advantage to RDJ? And leading to my next point, given that sa-update is working fine -- isn't rdj going to be slimmed down to just the part that restarts the process after running sa-update? Hi Jo, I'm the author of

Re: sa-update versus rulesdujour questions

2006-10-20 Thread Chris Thielen
Theo Van Dinter wrote: FWIW, it happens to be the official tool since no one ever submitted RDJ to be the official tool, so we had to write our own. I would have offered, had I known there was any interest. Chris T.

RE: sa-update versus rulesdujour questions

2006-10-20 Thread Bret Miller
Theo Van Dinter wrote: FWIW, it happens to be the official tool since no one ever submitted RDJ to be the official tool, so we had to write our own. I would have offered, had I known there was any interest. Chris T. I'm glad it isn't the official tool since it doesn't run natively on

RE: sa-update versus rulesdujour questions

2006-10-20 Thread Bowie Bailey
Bret Miller wrote: Theo Van Dinter wrote: FWIW, it happens to be the official tool since no one ever submitted RDJ to be the official tool, so we had to write our own. I would have offered, had I known there was any interest. Chris T. I'm glad it isn't the official tool

Re: sa-update versus rulesdujour questions

2006-10-19 Thread Jo Rhett
Daryl C. W. O'Shea wrote: To start, again, I have *nothing* against RDJ. I just like things to be as efficient as practical (it's how I live and make a living), which is why I like sa-update. I'll explain why sa-update is more efficient... [snip] Thank you very much for the detailed

Re: sa-update versus rulesdujour questions

2006-10-18 Thread Jo Rhett
Hm. I'm surprised on no answers. Can I persist? This topic is of real interest to me... Jo Rhett wrote: Okay, there's no docs on this so I wanted to ask if someone has any insights different than what I have observed. SA-Update seems to require less configuration changes. In short, all I

Re: sa-update versus rulesdujour questions

2006-10-18 Thread Tim Litwiller
I've never changed anything in local.cf when using RDJ - what did you have to change? Jo Rhett wrote: Hm. I'm surprised on no answers. Can I persist? This topic is of real interest to me... Jo Rhett wrote: Okay, there's no docs on this so I wanted to ask if someone has any insights

RE: sa-update versus rulesdujour questions

2006-10-18 Thread Chris Santerre
Title: RE: sa-update versus rulesdujour questions Hm. I'm surprised on no answers. Can I persist? This topic is of real interest to me... Last month this topic blew up into a flame fest. I compltely understand why no on wants in on this again. Short answer: use what you like

Re: sa-update versus rulesdujour questions

2006-10-18 Thread Jake Vickers
Tim Litwiller wrote: I've never changed anything in local.cf when using RDJ - what did you have to change? Jo Rhett wrote: Hm. I'm surprised on no answers. Can I persist? This topic is of real interest to me... Jo Rhett wrote: Okay, there's no docs on this so I wanted to ask if someone

Re: sa-update versus rulesdujour questions

2006-10-18 Thread Kelson
Jake Vickers wrote: Tim Litwiller wrote: I've never changed anything in local.cf when using RDJ - what did you have to change? ... I use RDJ myself, and also did not add anything to my local.cf to make it work. I adjusted some scores, but that was all. Me three. As many changes as I've

Re: sa-update versus rulesdujour questions

2006-10-18 Thread Jo Rhett
On Oct 18, 2006, at 11:25 AM, Chris Santerre wrote: Last month this topic blew up into a flame fest. I compltely understand why no on wants in on this again. Oops. I should have checked the archive. Short answer: use what you like. Of course. I was just wondering if there was certain

Re: sa-update versus rulesdujour questions

2006-10-18 Thread Jo Rhett
On Oct 18, 2006, at 11:15 AM, Tim Litwiller wrote: I've never changed anything in local.cf when using RDJ - what did you have to change? Reading RDJ setup, it kept mentioning that I would have to add statements to local.conf for each and every ruleset that I imported. This is why I

Re: sa-update versus rulesdujour questions

2006-10-18 Thread Tim Litwiller
... snip ... According to the home page for the script http://www.exit0.us/index.php?pagename=RulesDuJour Add a TRUSTED_RULESETS line to your config file that contains the names of the rulesets you chose. Example below: * TRUSTED_RULESETS=TRIPWIRE SARE_ADULT SARE_OBFU0 SARE_OBFU1

Re: sa-update versus rulesdujour questions

2006-10-18 Thread Adam Lanier
On Wed, 2006-10-18 at 12:14 -0700, Jo Rhett wrote: According to the home page for the script http://www.exit0.us/index.php?pagename=RulesDuJour Add a TRUSTED_RULESETS line to your config file that contains the names of the rulesets you chose. Example below: *

Re: sa-update versus rulesdujour questions

2006-10-18 Thread Kelson
Jo Rhett wrote: According to the home page for the script http://www.exit0.us/index.php?pagename=RulesDuJour Add a TRUSTED_RULESETS line to your config file that contains the names of the rulesets you chose. Example below: You missed the previous line: Create a blank configuration file

Re: sa-update versus rulesdujour questions

2006-10-18 Thread Michel R Vaillancourt
Jo Rhett wrote: On Oct 18, 2006, at 11:15 AM, Tim Litwiller wrote: I've never changed anything in local.cf when using RDJ - what did you have to change? Reading RDJ setup, it kept mentioning that I would have to add statements to local.conf for each and every ruleset that I imported. This

RE: sa-update versus rulesdujour questions

2006-10-18 Thread Bowie Bailey
Jo Rhett wrote: Hm. I'm surprised on no answers. Can I persist? This topic is of real interest to me... Jo Rhett wrote: Okay, there's no docs on this so I wanted to ask if someone has any insights different than what I have observed. SA-Update seems to require less configuration

Re: sa-update versus rulesdujour questions

2006-10-18 Thread Theo Van Dinter
On Wed, Oct 18, 2006 at 03:42:26PM -0400, Bowie Bailey wrote: They are both good. RDJ was made to deal with third party rulesets and it does a good job. sa-update was made to deal with official ruleset updates and has been extended to also handle third party rulesets. That's not exactly

Re: sa-update versus rulesdujour questions

2006-10-18 Thread Daryl C. W. O'Shea
To start, again, I have *nothing* against RDJ. I just like things to be as efficient as practical (it's how I live and make a living), which is why I like sa-update. I'll explain why sa-update is more efficient... Bowie Bailey wrote: I don't know that there is much difference in the

RE: sa-update versus rulesdujour questions

2006-10-18 Thread Bowie Bailey
Daryl C. W. O'Shea wrote: To start, again, I have *nothing* against RDJ. I just like things to be as efficient as practical (it's how I live and make a living), which is why I like sa-update. I'll explain why sa-update is more efficient... I wasn't intending to advocate either. I was just

sa-update versus rulesdujour questions

2006-10-17 Thread Jo Rhett
Okay, there's no docs on this so I wanted to ask if someone has any insights different than what I have observed. SA-Update seems to require less configuration changes. In short, all I did was make a file with a list of rulefiles that SA-Update should check, and everything worked without