7 ms·

Bro Network Security Monitor

33 points by sunilkumarc 12y ago

jmsdnns 12y ago
I first saw the name "bro" and thought, "ohh geez..." but then I took a look and found this is coming from very serious people. The kind of people that wouldn't make a brogrammer joke. Can anyone explain the name of the project?
- bri3d 12y ago
  Here's the original paper where the project is described: http://www.icir.org/vern/papers/bro-CN99.html http://www.icir.org/vern/papers/bro-CN99.html The name is short for "big brother" - an Orwell reference.
  - krakensden 12y ago
    Additionally, the name predates brosteria by several years.
  - tptacek 12y ago
    That paper is from 1999, but Bro probably predates that; I talked to Vern in person about Bro when we wrote our 1998 "Insertion Evasion" paper --- Vern had independently discovered many of the same design flaws we did and captured them in the Bro paper. Vern Paxson is extraordinarily serious; he was part of the LBL network research group team, alongside Van Jacobsen and Steve McCanne and Sally Floyd. That was one of the most famous network research teams in... well, the history of the Internet.
    - gonzo 12y ago
      let's not forget Craig Leres.
- tptacek 12y ago
  It's simply not a brogrammer joke. That's all there is to say about it.
  - Steuard 12y ago
    I hate to say it, but despite their prior claim to the name, today's reality means that the name will be a persistent distraction from the underlying product. It's not remotely fair, but that doesn't make it untrue. Just ask the diet pill company from the early 1980s that used to advertise "Ayds helps you control your appetite so you lose weight!" Or the many Hindus today who are frustrated that their Swastika earrings get mistaken for an endorsement of Nazism. Bro culture in tech is a poison, and one of the many crappy things about poison is its tendency to contaminate otherwise harmless things that happen to be nearby.
    - tptacek 12y ago
      Are you at all familiar with Bro? Could you, for instance, state some ways that it's different than it's leading open source competitor? (It would also be good if you knew who that was.) Or for that matter any of the innovations that Bro introduced? If you can, I'll take your argument seriously (although, fair warning, I'll take it seriously long enough to beat it to death with a shovel).
      - mikecb 12y ago
        Every time this is posted, and this discussion happens, I am reminded to never judge a brook by its cover. Edit: I'm going to leave that typo as is.
      - Steuard 12y ago
        I have not the slightest familiarity with Bro or its competitors, and I wouldn't dream of pretending to. My comment here is entirely from the perspective of an outsider hearing about the project and trying to figure out whether learning more about it could be valuable to me. I can see at least two very sensible ways in which the concern that I've shared here could be unimportant (and you may see others). I don't even know enough to know to what degree either applies here. One might be if nobody but an established specialist in the field would ever have a need to assess, use, or contribute to Bro or its competitors. In that case, the negative associations with the name would be unimportant: the specialists would be fully invested in the technical details, and the name wouldn't have any substantial exposure to the broader tech community. (The only cost would be occasional unimportant dust-ups when that exposure happens, as in this case.) Another might be if there is a good chance that the importance of this project will outlast the public prominence of bro culture in tech. (Given the longevity of Bro to date and the promising backlash against bro culture, that seems quite plausible.) In that case, it might be entirely sensible to just weather the current storm of negative associations and trust that everyone will have forgotten brogrammers in five years. (That's only fully applicable if they really are forgotten, though, rather than being a lingering negative memory.) You may have other reasonable arguments for setting aside the concerns that I've raised as well. But I do think that occasional undeserved distractions because of the name are inevitable, and I could imagine them being a real problem.
- alxndr 12y ago
  I had the same reaction. If they're going for a Big Brother reference, why not a name like BB or George[Orwell] or something from Newspeak?
  - Zikes 12y ago
    Because there is nothing wrong with the word "bro".
    - drivingmenuts 12y ago
      Seriously? Denotatively, it's meaningless. Connotatively, it's turned into a pretty objectionable term, in my opinion.
      - Zikes 12y ago
        Yes, seriously. It's just a word, like "sis" or "gal" or "the", and has no inherent negative or positive connotations. Somebody has invented drama around this word, some other people have bought into it, and now more people are just trying to stir it up again because Hacker News has somehow gone a whole two days without senseless bickering.
        gohrt 12y ago
        > has no inherent negative or positive connotations. That's not how 'connotation' works. http://en.wikipedia.org/wiki/Connotation http://en.wikipedia.org/wiki/Connotation
    - forgottenpass 12y ago
      There's no getting around it anymore. We have to accept the fact Bay Area startup culture has turned a term of endearment into a gendered slur.
      - Zikes 12y ago
        So we grow a backbone and tread on, ignoring the people trying to manufacture scandal for their own entertainment or empowerment, or we let one city's subculture control the rights to the English language. I choose the former.
deathhand 12y ago
I don't understand how this is any better than SNORT http://www.snort.org/ http://www.snort.org/
- d0ugie 12y ago
  Perhaps bro is free (unless you spring for commercial support) whereas with snort you may want to pay to subscribe to the filter updates (not certain). http://www.snort.org/vrt/buy-a-subscription http://www.snort.org/vrt/buy-a-subscription
- danielweber 12y ago
  Snort is more like a packet-filtering firewall, Bro is more like a protocol-lawyer firewall. That's a general description and misses a lot of details.
  - tptacek 12y ago
    No offense, but it's also extremely inaccurate; that is not a good dividing line to draw between the two projects. The previous Bro thread had a decent comparison between the two projects. If I was going to deploy a network IDS/IPS somewhere (spoiler: I wouldn't), it'd be Snort. If I was going to monitor a network in general, or do network monitoring research, I'd use Bro.
    - anonymousDan 12y ago
      Why wouldn't you deploy a network IDS/IPS out of interest? What problems do they have and what would you advise instead?
      - tptacek 12y ago
        Sometime when we're in an unburied thread and I'm not prepping to travel out of the country the next day, I'll be happy to write a couple thousand words on this. But fair warning, I probably won't say anything you wouldn't expect me to say after reading what I wrote about it back in '98 (Google [insertion evasion]).
moron4hire 12y ago
And the word "bro" means a lot more than just "brogrammer" in the wider world outside of Silicon Valley. It's not necessarily pejorative in all use cases. I think it's fine that this stays "bro". Don't let shitty web magazines dictate the language for the rest of us.
- tptacek 12y ago
  Can we stop pretending this is a controversy in which our opinions about the name matters? Bro has been Bro for almost as much time as the network simulator has been named "ns"; longer, in fact, than Pathchar. Bro simply is its name. There's no discussion to be had about it.
  - moron4hire 12y ago
    You know, I agree with you completely. It's really not an issue.
  - remor 12y ago
    Wait, wait! I've got it. Bro has been Bro longer than Google has been Google. <drops mic>.... http://www.google.com/about/company/history/ http://www.google.com/about/company/history/ http://www.bro.org/documentation/history.png http://www.bro.org/documentation/history.png
bibinou 12y ago
previously : https://news.ycombinator.com/item?id=7726177 https://news.ycombinator.com/item?id=7726177
dang 12y ago
This is an obvious dupe [1]. Submitters: please check for these. It's y The name is also, as that recent thread made clear, an obvious special case. And bikeshed flamewars are the last thing we need here—or rather two of the last things we need here, squared. If you have nothing substantive to say about a serious piece of work, not commenting at all is a wise choice. 1. https://hn.algolia.com/?q=bro+security#!/story/forever/0/bro%20security https://hn.algolia.com/?q=bro+security#!/story/forever/0/bro...
- remor 12y ago
  You should happy to note that the name is something we don't bikeshed about within the Bro project. The name is staying. It will far outlast the negativity.
JoachimSchipper 12y ago
I liked the following comment from the old thread, written by mavam: === (Disclaimer: Bro team member) First, Bro is a Turing-complete scripting language ("the Python for the network") and Snort/Suricata a system centered around regular-expression matching [1]. These two paradigms have fundamentally different levels of expressiveness. Second, Bro's core is policy-neutral. [Continued at https://news.ycombinator.com/item?id=7728850 https://news.ycombinator.com/item?id=7728850].

33 points by sunilkumarc 12y ago

I first saw the name "bro" and thought, "ohh geez..." but then I took a look and found this is coming from very serious people. The kind of people that wouldn't make a brogrammer joke. Can anyone explain the name of the project?

bri3d 12y ago
Here's the original paper where the project is described: http://www.icir.org/vern/papers/bro-CN99.html http://www.icir.org/vern/papers/bro-CN99.html The name is short for "big brother" - an Orwell reference.
- krakensden 12y ago
  Additionally, the name predates brosteria by several years.
- tptacek 12y ago
  That paper is from 1999, but Bro probably predates that; I talked to Vern in person about Bro when we wrote our 1998 "Insertion Evasion" paper --- Vern had independently discovered many of the same design flaws we did and captured them in the Bro paper. Vern Paxson is extraordinarily serious; he was part of the LBL network research group team, alongside Van Jacobsen and Steve McCanne and Sally Floyd. That was one of the most famous network research teams in... well, the history of the Internet.
  - gonzo 12y ago
    let's not forget Craig Leres.
tptacek 12y ago
It's simply not a brogrammer joke. That's all there is to say about it.
- Steuard 12y ago
  I hate to say it, but despite their prior claim to the name, today's reality means that the name will be a persistent distraction from the underlying product. It's not remotely fair, but that doesn't make it untrue. Just ask the diet pill company from the early 1980s that used to advertise "Ayds helps you control your appetite so you lose weight!" Or the many Hindus today who are frustrated that their Swastika earrings get mistaken for an endorsement of Nazism. Bro culture in tech is a poison, and one of the many crappy things about poison is its tendency to contaminate otherwise harmless things that happen to be nearby.
  - tptacek 12y ago
    Are you at all familiar with Bro? Could you, for instance, state some ways that it's different than it's leading open source competitor? (It would also be good if you knew who that was.) Or for that matter any of the innovations that Bro introduced? If you can, I'll take your argument seriously (although, fair warning, I'll take it seriously long enough to beat it to death with a shovel).
    - mikecb 12y ago
      Every time this is posted, and this discussion happens, I am reminded to never judge a brook by its cover. Edit: I'm going to leave that typo as is.
    - Steuard 12y ago
      I have not the slightest familiarity with Bro or its competitors, and I wouldn't dream of pretending to. My comment here is entirely from the perspective of an outsider hearing about the project and trying to figure out whether learning more about it could be valuable to me. I can see at least two very sensible ways in which the concern that I've shared here could be unimportant (and you may see others). I don't even know enough to know to what degree either applies here. One might be if nobody but an established specialist in the field would ever have a need to assess, use, or contribute to Bro or its competitors. In that case, the negative associations with the name would be unimportant: the specialists would be fully invested in the technical details, and the name wouldn't have any substantial exposure to the broader tech community. (The only cost would be occasional unimportant dust-ups when that exposure happens, as in this case.) Another might be if there is a good chance that the importance of this project will outlast the public prominence of bro culture in tech. (Given the longevity of Bro to date and the promising backlash against bro culture, that seems quite plausible.) In that case, it might be entirely sensible to just weather the current storm of negative associations and trust that everyone will have forgotten brogrammers in five years. (That's only fully applicable if they really are forgotten, though, rather than being a lingering negative memory.) You may have other reasonable arguments for setting aside the concerns that I've raised as well. But I do think that occasional undeserved distractions because of the name are inevitable, and I could imagine them being a real problem.
alxndr 12y ago
I had the same reaction. If they're going for a Big Brother reference, why not a name like BB or George[Orwell] or something from Newspeak?
- Zikes 12y ago
  Because there is nothing wrong with the word "bro".
  - drivingmenuts 12y ago
    Seriously? Denotatively, it's meaningless. Connotatively, it's turned into a pretty objectionable term, in my opinion.
    - Zikes 12y ago
      Yes, seriously. It's just a word, like "sis" or "gal" or "the", and has no inherent negative or positive connotations. Somebody has invented drama around this word, some other people have bought into it, and now more people are just trying to stir it up again because Hacker News has somehow gone a whole two days without senseless bickering.
      - gohrt 12y ago
        > has no inherent negative or positive connotations. That's not how 'connotation' works. http://en.wikipedia.org/wiki/Connotation http://en.wikipedia.org/wiki/Connotation
  - forgottenpass 12y ago
    There's no getting around it anymore. We have to accept the fact Bay Area startup culture has turned a term of endearment into a gendered slur.
    - Zikes 12y ago
      So we grow a backbone and tread on, ignoring the people trying to manufacture scandal for their own entertainment or empowerment, or we let one city's subculture control the rights to the English language. I choose the former.

deathhand 12y ago

I don't understand how this is any better than SNORT http://www.snort.org/ http://www.snort.org/

d0ugie 12y ago
Perhaps bro is free (unless you spring for commercial support) whereas with snort you may want to pay to subscribe to the filter updates (not certain). http://www.snort.org/vrt/buy-a-subscription http://www.snort.org/vrt/buy-a-subscription
danielweber 12y ago
Snort is more like a packet-filtering firewall, Bro is more like a protocol-lawyer firewall. That's a general description and misses a lot of details.
- tptacek 12y ago
  No offense, but it's also extremely inaccurate; that is not a good dividing line to draw between the two projects. The previous Bro thread had a decent comparison between the two projects. If I was going to deploy a network IDS/IPS somewhere (spoiler: I wouldn't), it'd be Snort. If I was going to monitor a network in general, or do network monitoring research, I'd use Bro.
  - anonymousDan 12y ago
    Why wouldn't you deploy a network IDS/IPS out of interest? What problems do they have and what would you advise instead?
    - tptacek 12y ago
      Sometime when we're in an unburied thread and I'm not prepping to travel out of the country the next day, I'll be happy to write a couple thousand words on this. But fair warning, I probably won't say anything you wouldn't expect me to say after reading what I wrote about it back in '98 (Google [insertion evasion]).

moron4hire 12y ago

And the word "bro" means a lot more than just "brogrammer" in the wider world outside of Silicon Valley. It's not necessarily pejorative in all use cases. I think it's fine that this stays "bro". Don't let shitty web magazines dictate the language for the rest of us.

tptacek 12y ago
Can we stop pretending this is a controversy in which our opinions about the name matters? Bro has been Bro for almost as much time as the network simulator has been named "ns"; longer, in fact, than Pathchar. Bro simply is its name. There's no discussion to be had about it.
- moron4hire 12y ago
  You know, I agree with you completely. It's really not an issue.
- remor 12y ago
  Wait, wait! I've got it. Bro has been Bro longer than Google has been Google. <drops mic>.... http://www.google.com/about/company/history/ http://www.google.com/about/company/history/ http://www.bro.org/documentation/history.png http://www.bro.org/documentation/history.png

bibinou 12y ago

previously : https://news.ycombinator.com/item?id=7726177 https://news.ycombinator.com/item?id=7726177

dang 12y ago

This is an obvious dupe [1]. Submitters: please check for these. It's y The name is also, as that recent thread made clear, an obvious special case. And bikeshed flamewars are the last thing we need here—or rather two of the last things we need here, squared. If you have nothing substantive to say about a serious piece of work, not commenting at all is a wise choice. 1. https://hn.algolia.com/?q=bro+security#!/story/forever/0/bro%20security https://hn.algolia.com/?q=bro+security#!/story/forever/0/bro...

remor 12y ago
You should happy to note that the name is something we don't bikeshed about within the Bro project. The name is staying. It will far outlast the negativity.

JoachimSchipper 12y ago

I liked the following comment from the old thread, written by mavam: === (Disclaimer: Bro team member) First, Bro is a Turing-complete scripting language ("the Python for the network") and Snort/Suricata a system centered around regular-expression matching [1]. These two paradigms have fundamentally different levels of expressiveness. Second, Bro's core is policy-neutral. [Continued at https://news.ycombinator.com/item?id=7728850 https://news.ycombinator.com/item?id=7728850].