On 2012-10-04 at 11:02:46 -0400, Lawrence Teo wrote:
> On Thu, Oct 04, 2012 at 08:52:36AM -0400, Adam Jeanguenat wrote:
> > In the snort.org URLs above, I would recommend replacing 'sub-rules'
> > with 'reg-rules'. The 'sub-rules' URLs are for the paid subscription
> > rules and I believe will fail if your oink code is associated with a
> > non-paid account.
>
> Adam, thank you for the comment. 'sub-rules' will still work for a
> non-paid account; it will just fallback to giving you the non-paid rules
> tarball. For example I don't have a paid subscription but I can
> download the free 1-month-old rules tarball using the 'sub-rules' URL
> with my oinkcode.
Thanks for clarifying this. I use paid subscriptions and didn't have a
chance to register a new account and test with a non-paid oink code.
Without the clarification, some confusion could arise in the future.
For example, when a new Snort release occurs (let's call it 2.9.4),
snortrules-snapshot-2940.tar.gz will exist only for the 'sub-rules' set
for the first 30 days. I'm not sure what happens when a non-paid oink
code tries to hit grab a paid ruleset that doesn't have a corresponding
non-paid version.
--avj
