Re: [prelude-user] [RFC]: Switching Prelude-Correlator rules to Python

I tried to write new rules recently, but got turned off by the idea of having to learn lua.  I'd welcome a switch to Python.

- Ramon

This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed.  If you have received this email in error please notify the system manager.  This communication may contain material protected by the attorney-client privilege or other privileges or protections from discovery,  such as California Evidence Code Section 1157, et seq. 
If you are not the named addressee you should not disseminate, distribute or copy this e-mail, but should instead destroy it.  Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. 


----- Original Message -----
From: [email protected] <[email protected]>
To: [email protected] <[email protected]>; prelude-devel <[email protected]>
Sent: Tue Apr 14 00:41:02 2009
Subject: [prelude-user] [RFC]: Switching Prelude-Correlator rules to Python

Hi folks,

We are currently evaluating the move of Prelude-Correlator ruleset
language away from Lua to Python, and would like to get your feedback.

Lua is a very good language which is suited for specific needs. Some of
it's advantage come from its speed (more than twice as fast as Python),
and its size.

There is also a number of drawback:

- Lua has a simple syntax, that prove to be very restrictive. It is
currently mandatory to nest code (no break/continue instruction for loop
control), that can make correlation rule kind of difficult to read.

- The Lua API seems to be frequently changing. Version 4.x, 5.0 and 5.1
bring changes to the Lua language itself. The C interface used to make
Lua interoperable with Prelude-Correlator is subject to change too.

- This remain to be proved, but I feel that there are more Python aware
developers in our targeted audience.

- Lua is not as widespread as Python, some Lua correlation rules could
require extensions that are not available on all systems.

- A number of day to day utility function that are useful for rules
writing are missing from Lua. This force us to build our own library of
function, which is much more time consuming than using an existing
library.


We would be very interested in hearing what you think about this
potential move.

Thanks,

-- 
Yoann Vandoorselaere <[email protected]>
PreludeIDS Technologies

_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user
_______________________________________________
Prelude-devel site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-devel