<HTML>
<HEAD>
<TITLE>Re: [Oisf-wg-configuration_language] please do not write our own parser</TITLE>
</HEAD>
<BODY>
<FONT FACE="Calibri, Verdana, Helvetica, Arial"><SPAN STYLE='font-size:11pt'>Good idea. I’ve used YAML on several projects before (Python and PHP) and found it to be quite good – both in terms of what it supports and in terms of making the team think clearly about what needed support – if it was ‘too difficult’ in YAML, we were probably (and in retrospect, generally) Doing Something Wrong.<BR>
<BR>
But that’s really not the point. I’m firmly with Scott’s sentiments on this, and would further say that we should devote a few refactoring cycles to identifying and ruthlessly eliminating any NIHisms in our code base. Especially if we’re going to eventually air our dirty laundry through open source, anything we do that is yet another implementation of a core infrastructure pattern should build on existing, proven code as much as possible. If we say “yeah, Project Q does 95% of what we need, but not everything,” then, instead of writing a whole new implementation, either work within the existing Project Q community or explicitly fork their stuff to add ours.... since they’ve already got most of what we need anyway. YAML is successful <B>even though</B> it’s yet another config language <B>because</B> it adds value over and above the traditional alternatives – binary bit soup, INI files or XML. Other successful projects that solve common problems can, almost universally, say the same thing.<BR>
<BR>
My two rupiah worth, anyway.<BR>
<BR>
Jeff<BR>
<BR>
<BR>
On 22/9/09 24:52 , "Jason Ish" <<a href="ish@unx.ca">ish@unx.ca</a>> wrote:<BR>
<BR>
</SPAN></FONT><BLOCKQUOTE><FONT FACE="Calibri, Verdana, Helvetica, Arial"><SPAN STYLE='font-size:11pt'>On Mon, Sep 21, 2009 at 8:36 AM, Scott MacGregor <<a href="shadowbq@gmail.com">shadowbq@gmail.com</a>> wrote:<BR>
</SPAN></FONT><BLOCKQUOTE><FONT FACE="Calibri, Verdana, Helvetica, Arial"><SPAN STYLE='font-size:11pt'>Writing our own parser is no better than what snort did, folks.. There<BR>
is no consensus on what snort "configurations" are capable with which<BR>
versions of snort.<BR>
<BR>
I feel that YAML is a good direction.<BR>
</SPAN></FONT></BLOCKQUOTE><FONT FACE="Calibri, Verdana, Helvetica, Arial"><SPAN STYLE='font-size:11pt'><BR>
We've stuck with YAML. Nothing seemed as perfect as doing a custom grammar, but this came close enough.<BR>
<BR>
Jason<BR>
<BR>
<BR>
<HR ALIGN=CENTER SIZE="3" WIDTH="95%"></SPAN></FONT><FONT SIZE="2"><FONT FACE="Consolas, Courier New, Courier"><SPAN STYLE='font-size:10pt'>_______________________________________________<BR>
Oisf-wg-configuration_language mailing list<BR>
<a href="Oisf-wg-configuration_language@openinfosecfoundation.org">Oisf-wg-configuration_language@openinfosecfoundation.org</a><BR>
<a href="http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-wg-configuration_language">http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-wg-configuration_language</a><BR>
</SPAN></FONT></FONT></BLOCKQUOTE><FONT SIZE="2"><FONT FACE="Consolas, Courier New, Courier"><SPAN STYLE='font-size:10pt'><BR>
</SPAN></FONT></FONT><FONT FACE="Calibri, Verdana, Helvetica, Arial"><SPAN STYLE='font-size:11pt'>-- <BR>
</SPAN></FONT><SPAN STYLE='font-size:11pt'><FONT FACE="Courier New">Jeff Dickey <a href="http://archlever.blogspot.com/">http://archlever.blogspot.com/</a><BR>
Email: <a href="jdickey@seven-sigma.com">jdickey@seven-sigma.com</a><BR>
Phone/SMS: +65 8333 4403<BR>
Skype: jeff_dickey<BR>
LinkedIn: jdickey<BR>
Yahoo! IM: jeff_dickey<BR>
MSN IM: <a href="jeff_dickey@hotmail.com">jeff_dickey@hotmail.com</a> (for IM only, please)<BR>
ICQ: 8053918<BR>
QQ: 30302349<BR>
GnuPG key:<BR>
Fingerprint D367 FB97 4E59 BEC0 8EBC D8E3 3BD4 7D4C DFE0 6488<BR>
Valid from 01 July 2009 to 31 December 2009<BR>
Download from <a href="http://tr.im/qqQa">http://tr.im/qqQa</a></FONT><FONT FACE="Calibri, Verdana, Helvetica, Arial"><BR>
</FONT></SPAN>
</BODY>
</HTML>