>-----Original Message----- >From: Fred [mailto:[EMAIL PROTECTED] >Sent: Tuesday, August 24, 2004 11:44 PM >To: [EMAIL PROTECTED]; Justin Mason >Cc: [email protected] >Subject: Re: daily updates > > >Justin Mason wrote: >> BTW, I think you guys (SARE that is) are using mass-check to measure >> accuracy, right? > >Yes we have 3 members who test against a corpus using Bobs mass-check >script. >We plan to use the perceptron when 3.0 is released to score >our rules by >taking the stock rules into consideration, hoping to make life >better for >all.
Yup and more SARE members planning to start testing....soon ;) > > >> (BTW I should qualify what Daniel means by "non-heavyweight" >-- in other >> words, the rule doesn't greatly affect speed/RAM usage. I >think that's >> what he means at least.) > Shall forever be known as the bigevil effect :) >That's how I took it, now with the plugin ability I wanted to >convert my >tripwire ruleset into a plugin, do you see any possible way to >do this and >use less memory than my current approach? This is key to what SARE would like to do. We would like rules to be smaller and quicker, and hope that evals make this possible. Kind of a new territory for us. > > >> If we can work something out, that'll be great ;) >> > >I agree, we always wanted to keep things close without >crossing lines, those >lines are hard to see but each step taken helps define it all. I'm getting that warm fuzzy feeling again...wait, nope...I spilt my coffee. > I >congradulate you on the great project you have on your hands, Same here. SA is the building block, the original, the engine, the catalyst, and the shiznits. Great work by devs! Also, please let us know if you want certain rules. Most of us have filled out an apache license. --Chris
