News for hackers. Stuff that matters.
Re:Osquery: An sqlite3 virtual table exposing operating syst... by woodruffw on Sunday February 25, 2024 @07:07PM (#39506325)
There's at least one open data quality issue for `process_open_sockets` on macOS[1]. It's a few years old however and, if you aren't seeing that casting error, you probably aren't hitting it. But that's a good example of the kind of debt that's been built up over time.

(In terms of general purpose/flexible tooling, I'm not aware of a close replacement for osquery.)

[1]: https://github.com/osquery/osquery/issues/6319

Re:Osquery: An sqlite3 virtual table exposing operating syst... by Myrmornis on Sunday February 25, 2024 @07:16PM (#39506378)
Thanks! I'll watch out for that one.
Re:Osquery: An sqlite3 virtual table exposing operating syst... by mikermcneil on Sunday February 25, 2024 @09:42PM (#39507116)
Was about to say "will fix ASAP", but double-plus since it's @nyanshak!
Re:Osquery: An sqlite3 virtual table exposing operating syst... by noahtaleran on Monday February 26, 2024 @02:17PM (#39515669)
Yo! We're working on the fix. You can track progress here: https://github.com/fleetdm/fleet/issues/17165