MIG author here.
MIG author here. First, congrats to Mike Arpaia for shipping! That must have been a busy couple of months :) There is a number of conceptual differences between MIG, GRR and OSquery. MIG does not retrieve data from endpoints, but instead focuses on answering yes/no questions. For example: find hosts that have a file in /var/www that contains the regex '12345'. MIG will run the search on all endpoints and return the location of files and hosts that match. But it won't return the files themselves. Privacy is preserved, but investigators need to manually retrieve files if needed. MIG takes this approach to keep the search very fast (parallel AMQP runs in seconds across thousands of endpoints). Retrieving data at large scale is too expensive for Mozilla (bandwidth, storage, execution time), and we like to protect privacy. I really like the SQL approach taken by osquery. I brainstormed something similar last year [1] but did not get around to it yet. SQL is very natural to use for a lot of IT/Security people, and it's great to be able to transfer that knowledge to search tools. GRR and OSquery are awesome tools. And I can tell their authors are solving some really hard problems. We're competing a bit, but it's OK to have multiple tools with varying goals. And it's great for borrowing each other's good ideas ;) [1] http://4u.1nw.eu/Presentation_workweek_20130916.pdf slides 10 & 11
Posted by jvehent on Oct 30, 2014, 1:51 AM
Tags
Related issues
- A lot of the rare books seem to be books that are most relevant to specific professions within specific countries.
- docs: Add DeepSeek V4 Pro/Flash support to agent-model-matching guide
- It's cute, looks nice, and bravo for shipping something, but FZ is too hyped and too expensive for what it is.
- I'd really like to see a plug-in hybrid pickup where I can do 10-20 miles on a charge without needing the gas engine to even kick on.
- There are places where solar is less than helpful -- up here in Scotland, we're north of Moscow: in midwinter we get as little as 4.5 hou...
- Too niche, not enough profits.
Raise real-world problems, find people facing the same issue, and discuss solutions.9,000 issues0 comments
pricing (Logistics)
A lot of the rare books seem to be books that are most relevant to specific professions within specific countries.
docs: Add DeepSeek V4 Pro/Flash support to agent-model-matching guide
It's cute, looks nice, and bravo for shipping something, but FZ is too hyped and too expensive for what it is.
I'd really like to see a plug-in hybrid pickup where I can do 10-20 miles on a charge without needing the gas engine to even kick on.
There are places where solar is less than helpful -- up here in Scotland, we're north of Moscow: in midwinter we get as little as 4.5 hou...
Too niche, not enough profits.
MIG author here.
Factor in the energy cost of making CFL/LED bulbs (including the additional electronics and mining the required material and all the...
MIG author here.
MIG author here. First, congrats to Mike Arpaia for shipping! That must have been a busy couple of months :) There is a number of conceptual differences between MIG, GRR and OSquery. MIG does not retrieve data from endpoints, but instead focuses on answering yes/no questions. For example: find hosts that have a file in /var/www that contains the regex '12345'. MIG will run the search on all endpoints and return the location of files and hosts that match. But it won't return the files themselves. Privacy is preserved, but investigators need to manually retrieve files if needed. MIG takes this approach to keep the search very fast (parallel AMQP runs in seconds across thousands of endpoints). Retrieving data at large scale is too expensive for Mozilla (bandwidth, storage, execution time), and we like to protect privacy. I really like the SQL approach taken by osquery. I brainstormed something similar last year [1] but did not get around to it yet. SQL is very natural to use for a lot of IT/Security people, and it's great to be able to transfer that knowledge to search tools. GRR and OSquery are awesome tools. And I can tell their authors are solving some really hard problems. We're competing a bit, but it's OK to have multiple tools with varying goals. And it's great for borrowing each other's good ideas ;) [1] http://4u.1nw.eu/Presentation_workweek_20130916.pdf slides 10 & 11
Comments (0)
No comments yet. Start the discussion.