On Thu, 30 Jan 2014, Kevin A. McGrail wrote:
On 1/30/2014 1:25 PM, John Hardin wrote:
I'd suggest writing it as a subrule first, to see how well it performs
against the masscheck corpora. If it does well by itself (good hits, high
S/O), then a meta can be added to expose it for scoring. If it hits a lot
but the S/O ratio is low, then it could be analyzed for possible
combinations with other rules to get something that performs well.
I think that's overkill and I've already added it to masscheck to see how it
does with a ceiling of 2 on the scoring so we can get some feedback and
adjust.
Otherwise, my POV is that masscheck is designed just for that purpose and
check if the rule has merits to move to publish.
I could be persuaded for a lower-score ceiling or a nopublish flag if you
insist though.
Eh, no, that's fine. I'm more interested in not ignoring rules that will
potentially be very useful in combination if they don't perform well on
their own. If it doesn't perform well enough to publish, or gets a low
score, then we can look at overlaps to see if a combination meta would
help.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhar...@impsec.org FALaholic #11174 pgpk -a jhar...@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
For those who are being swayed by Microsoft's whining about the
GPL, consider how aggressively viral their Shared Source license is:
If you've *ever* seen *any* MS code covered by the Shared Source
license, you're infected for life. MS can sue you for Intellectual
Property misappropriation whenever they like, so you'd better not
come up with any Innovative Ideas that they want to Embrace...
-----------------------------------------------------------------------
2 days until the 11st anniversary of the loss of STS-107 Columbia
