[RFC]: Switching Prelude-Correlator rules to Python

Hi folks,

We are currently evaluating the move of Prelude-Correlator ruleset
language away from Lua to Python, and would like to get your feedback.

Lua is a very good language which is suited for specific needs. Some of
it's advantage come from its speed (more than twice as fast as Python),
and its size.

There is also a number of drawback:

- Lua has a simple syntax, that prove to be very restrictive. It is
currently mandatory to nest code (no break/continue instruction for loop
control), that can make correlation rule kind of difficult to read.

- The Lua API seems to be frequently changing. Version 4.x, 5.0 and 5.1
bring changes to the Lua language itself. The C interface used to make
Lua interoperable with Prelude-Correlator is subject to change too.

- This remain to be proved, but I feel that there are more Python aware
developers in our targeted audience.

- Lua is not as widespread as Python, some Lua correlation rules could
require extensions that are not available on all systems.

- A number of day to day utility function that are useful for rules
writing are missing from Lua. This force us to build our own library of
function, which is much more time consuming than using an existing
library.


We would be very interested in hearing what you think about this
potential move.

Thanks,

-- 
Yoann Vandoorselaere <[email protected]>
PreludeIDS Technologies

_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user