Snort.org feature: Mailing list subscription upon signup

For those of you that have been part of the Snort community for awhile, you know that the best place to go for help with your Snort installation, rule writing, even to keep tabs on the development of Snort, has been the mailing lists.

When Snort's downloads were hosted on Sourceforge, (which we stopped doing at Snort 2.9.7.6), adding yourself to one of our four mailing lists was part of the experience.  So we wanted to make it simple for new users to add themselves to the mailing list, and get help with their installation and usage of Snort.

As a new feature, when a new user is created on Snort.org, we give you the option of subscribing to one (or all) of our mailing lists.  You will still have to confirm your subscription, just like any other user, but hopefully this should help people find our list, archives, and the growing community of Snort users.

With over 1,000 new signups a week on Snort.org, we hope that people will join our lists and participate with some of our more seasoned veterans!  We also hope that our seasoned veterans will help out the new guys, remember, we were all beginners once.

Snort 2.9.8.0 Installation Guides have been posted!

Thanks to our hard working community members William Parker and Noah Dietrich, the installation guides for Snort 2.9.8.0 have been posted on Snort.org!

We love it when our community pitches in and sends us documentation, FAQ updates, startup scripts, hints and tricks (which belong in the FAQ!)

If you'd like to contribute to the documentation repository, just email us at sfcommunity@cisco.com, and we can highlight your work, or, if you'd like to help out with the FAQ, we host it on Github, and allow anyone to submit a pull request against the docs.  Please considering helping out!

Snort FAQ is now on Snort.org!

When the old Snort.org was still around, we had a section for the FAQ on the documents page. However, contributions to the pages involved sending in suggestions to the admins of the site, via email, and then the changes would be shoved onto the site using regular old html, and then the site had to be pushed.

While this worked, it truly wasn't in the same participatory community that has made many open source projects, including ours, truly inclusive of the community. To counter this, the FAQ was moved to github. Here it allowed forking, editing, pull requests, etc, all in the easy to understand format of Markdown.

Since the move we've had several hundred changes submitted by way of pull request through github, as well as people submitting information the old fashioned way, via the mailing list, or email directly to us. However, the FAQ was on github itself, requiring you to visit an external page off of Snort.org, and then somehow navigate back, if you wanted more content on Snort.org such as other documentation.  

We found this experience to be cumbersome and downright awkward. The user experience was bad, and while no one really complained a great deal, we thought we could do better. 

So now, the FAQ is back on Snort.org. While the content is rendered seamlessly on the page, the meat of the information is actually pulled from Github. This allows the best of both worlds, to allow the user experience of github and allow forks, pulls, etc, the content is now beautifully rendered on Snort.org, providing a much better experience. 

We'd like the community to participate, to create pages, update FAQs, and provide content that you believe would help the Snort community.  You may do so by going to Snort's github page, and either forking, making edits, and submitting back to us, or creating a branch and submitting back to us. We'll review the content for integrity and to ensure it is correct, so we don't have bad, incorrect, or mis-information out there. 

The intent is to make Snort.org, truly the home, of Snort and its ecosystem.  There are around 60 known projects out there that participate or create a project to augment Snort, its input, output, or analysis.  I'd love for every one of those projects to have their own section in the FAQ.

Got an answer to a question that is asked every day on Snort's mailing list?  Create an FAQ page for it, let's point people to that.  Wrote some documentation to help people out with turning off LRO on their NIC?  Submit it!

Let's create a documentation repository.  We'll keep it cleaned up, neat and tidy on the site and make sure we are following all the appropriate rules surrounding content as well as layout in Markdown, etc.  But the content should be living, changing, and updated, and I'd love to have everyone participate.

Check out the Snort.org Documentation page, you'll see on the left hand side the "Snort FAQ".  You'll see all the current pages on the FAQ that people have created over the years, as well as the READMEs that are contained in the doc/ section of the Snort tarball.  Along with the Snort Manual that is also linked from the Documentation page, it should be much simpler to find the answers you need to almost any Snort question.  If you want to participate, head on over to the Github page, create your own branch, and start editing!

I'll be moving some of the one-off documentation that we have on Snort.org to the FAQ in coming days.

For a Markdown primer, head on over to Daring Fireball, the creator of the Markdown format.

A big thanks to our web team here in the Talos Group for making this happen!

Why are rules on/off by default?

One of the questions we receive here at Snort Headquarters a lot within the Vulnerability Research Team (VRT) is "Why are rules on/off by default"

I've explained what is the criteria is for the three policies (Connectivity, Balanced, and Security) already in previous blog posts here, but we thought we'd expand on that subject a bit and add it to the Snort FAQ.


So here you go:

https://github.com/vrtadmin/snort-faq/blob/master/Rules/Why-are-rules-commented-out.md

Snort FAQ is open for community involvement!

Following the success of our ClamAV FAQ being placed on Github, we decided to do the same thing to the Snort FAQ in hopes that it will make the content available to community users to submit content to and make it easily manageable.

So, now available: https://github.com/vrtadmin/snort-faq/blob/master/README.md

The reason we put it on Github is it makes it simple to edit (in Markdown format), it's easy to audit, it's easy to clone and import, etc.  When we did this with the ClamAV FAQ, we found it made the content super easy to keep up to date, allows for several users to work on it and allows for community involvement.

So this is what we are hoping you will do.  I took the old FAQ that was on http://www.snort.org, converted it to Markdown and committed it to Github.

Now we can add things like "Having a problem capturing TCP traffic?  Have you tried "-k none" in your testing?"

So, have at it.  We'll review all content and approve it as it comes in through your pull requests.