Re: [sleuthkit-developers] Good vs. Bad Hashes

[Matthias H. <mat...@mh...>]

Brian Carrier said:
> I'll just keep this on the developers list.
>
> On Thursday, January 22, 2004, at 06:26  PM, Matthias Hofherr wrote:
[...]
>
> Can you lead the effort on making such a list then?

I'll give it a try.

> I can't imagine
> having more than 15 categories.  Otherwise it gets too messy and would
> be too difficult to look at in the configuration window.

I,too, think less categories are better. Yet we have two major kind of
categories:
- operation systems: always known-goods, not so many categories, many
  hash-sets
- applications:  many categories, which have to be compressed to,
  let's say 15 categories; may be both known-goods or known-bads

I will give the matter some thoughts, talk with some people and compile
a first proposal for the list. If anyone on this list is also interested
in this matter, drop me a mail off list.

Matthias