[clamav-users] Minor bug or working as intended?

[Laurent S.]

On Wednesday, March 2nd, 2022 at 18:37, Kris Deugau <kdeugau at vianet.ca> wrote:

> Kris Deugau wrote:
> 

> > For some types of content, just allowing a plain ASCII string instead of
> > 

> > the hex-coded version of the same would be a big help. Or an
> > 

> > enhancement in the current file formats allowing embedded comments -
> > 

> > I've lost track of how many times I've created something complex, and
> > 

> > had to reconstruct whatever logic I used to create it to make a tweak or
> > 

> > refinement - or just gave up and created a new signature - because
> > 

> > there's no way to document it in-band. Ignoring empty lines -
> > 

> > especially at the end of the signature file! - instead of just claiming
> > 

> > "invalid signature" would ease editing.
> 


We are using a small GUI where you can create (as strings) and view (as strings) all the hundreds of simple .ndb signatures with a database and automatic expiration. But yes, having a similar sig format where you can just input strings... that could be easier to manage.

Concerning KDL, I'd really prefer a reliable implementation of YARA for the compatibility with other softwares. There are plenty of yara rules on the web, and it would be awesome to be able to import them easily.

Best,
Laurent

PS: Sorry for replying late
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 855 bytes
Desc: OpenPGP digital signature
URL: <https://lists.clamav.net/pipermail/clamav-users/attachments/20220304/46d86a1a/attachment.sig>