RE: IDS Correlation

From: Marcus J. Ranum (mjr@nfr.com)
Date: 03/28/02 

Date: Thu, 28 Mar 2002 11:33:19 -0500
To: "Matthew F. Caldwell" <mattc@guarded.net>, "Jared A. Tucker" <jared.tucker@terradon.com>, <eddonega@WellsFargo.COM>, "Keith T. Morgan" <keith.morgan@terradon.com>
From: "Marcus J. Ranum" <mjr@nfr.com>

Matthew F. Caldwell wrote:
>XML is great but bloated

Just like everything, it can be overengineered. The concepts
aren't awful, though. The stuff I've been doing with fargo
uses a subset of XML - which should work through an XML parser
but that only uses a minimum of tags, etc. The reality of them
matter is that you're going to need some kind of record delineation,
whether it's commas, newlines, attr=value, or whatever.

Otherwise you've got to crush everything into text and then have
a de-parser on the other side. Considered otherwise, that's
basically the same thing as doing a compression/decompression
process (only harder to implement!) on the data. In other words,
I don't think you can win this fight and the correct tool(s) to
make the problem go away are found in compression algorithms,
not in simpler (or more complex!) markup schemes.

mjr. 

---
Marcus J. Ranum          Chief Technology Officer, NFR Security, Inc.
Work:                    http://www.nfr.com
Personal:                http://www.ranum.com

Relevant Pages

  • Re: XML Alternatives
    ... No offence but I find this XML stuff awful and don't see the point. ... Imagine if C++ had to be coded that way: ...
    (comp.programming)
  • Re: XML Alternatives
    ... On Feb 12, 1:41pm, Lars Uffmann wrote ... No offence but I find this XML stuff awful and don't see the point. ...
    (comp.programming)
  • Re: XML Alternatives
    ... No offence but I find this XML stuff awful and don't see the point. ... Wasted a lot of time recently on xml for data, in the end went back to CDF/space-delimited text files that were both far more human- and machine-readable. ... line oriented file formats are IMO preferable for a large number of tasks. ... S-Exps were not sufficiently flexible, and I felt I needed the addition of tag-based structuring, attributes, ... ...
    (comp.programming)
  • Re: XML Alternatives
    ... On Feb 12, 1:41pm, Lars Uffmann wrote ... No offence but I find this XML stuff awful and don't see the point. ...
    (comp.programming)