base/frameworks/notice/extend-email/hostnames.bro cannot be easily disabled

Description

While offering an often desired feature, base/frameworks/notice/extend-email/hostnames.bro cannot be unloaded by users without modifying the scripts in base. Generally, it's considered a best practice to leave base alone.

I encountered this issue while trying to help someone determine why it was that they could not disable this script on the IRC channel.

I'd like to recommend moving this script to be loaded in the default local.bro (similar to how MHR is handled today) or adding a feature in the script for the feature to be disabled.

I'm more than happy to implement this and submit a pull request if someone can provide feedback on how this sort of thing should be handled.

Environment

None

Activity

Show:
Robin Sommer
April 27, 2018, 4:20 AM

What you suggest makes sense to me: move to policy and add to local.bro.

Stephen Hosom
May 10, 2018, 11:20 PM

Submitted a proposed fix for this today on GitHub:

https://github.com/bro/bro/pull/133

Jon Siwek
May 11, 2018, 2:30 AM

This is merged now, thanks.

Merged

Assignee

Jon Siwek

Reporter

Stephen Hosom

Labels

External issue ID

None

Components

Fix versions

Affects versions

Priority

Normal