[ossec-dev] Re: an idea?

[Brad Lhotsky <lhotskyb@xxxxxxxxxxxx>]

for RPM based systems (and from my perspective), rpm -ql packagename vs
the changes would severely limit the number of false positives.

Patrick Roelke wrote:
> 
> I think the idea has been raised before. I believe the consensus is it
> was difficult to implement as it was difficult to discern what yum was
> doing versus something malicious.
> 
> 
> On 6/5/07, Brad Lhotsky <lhotskyb@xxxxxxxxxxxx> wrote:

-- 
Brad Lhotsky                            <lhotskyb@xxxxxxxxxxxx>
NCTS Computer Specialist                    Phone: 410.558.8006
"Darkness is a state of mind, I can go where you would stumble."
 -Wolfsheim, 'Blind'