Probably only good things. Snort now is really not optimized and case only problems. Lets all hope it will be better now. But for giving a real answer I will ask the support tomorrow and if there is an answer for that already I will inform here.
I don't think the purchase of Snort by Cisco will change anything in the short term; all the companies (including direct competitors of Cisco's) using Snort likely have contracts in place that guarantee services / licensing be provided for an extended term despite who owns the company. I also find it unlikely that they (Cisco) would change anything significantly regarding Sourcefire's commercial offerings to 3rd parties for quite a while, nice to have the extra revenue stream [:)]
I wouldn't be surprised, however, if Sophos and other companies that relied on Sourcefire develop their own IPS engines at some point... I imagine many of them are already doing that anyway. There are also 1 or 2 other (may be more that I'm not familiar with) other open source projects for competing IPS systems out there.
Agree with Bruce. Over the short term don't expect too many changes. Over the long term however I do see there being some changes. I wouldn't be surprised to see part of the dev team for Snort fork their own project from the last 'free' release before Cisco's takeover. Look at what's happened with Open Office and MySQL, same general scenario.
As to what various companies that depend on snort, some may re-license under Cisco when the time comes, some may jump in with a fork of Snort, some may just take their own fork of snort, and some may find a small startup trying to out-snort snort.
If Sophos has their own in-house IPS, don't be too surprised if it shows up in the UTM.
Plus, the software is Open Source and GPL licensed. Maybe someone more-familar with that can comment on whether Snort can be withdrawn from that. I think Sourcefire has their own "Advanced IPS" that they sell that's a separate code base - at least, that's my interpretation without ever haing asked.
Hi Bob, many open-source projects have become closed-source or re-licensed to a different open-source license.
Nonetheless, the last GPL version is still GPL (until the copyright runs out and it's public domain), and new development can continue from there (forking).
Sourcefire's 'Advanced IPS' is probably Snort + extra patches, but I'm guessing.
Given the nearly 100% overlap between Cisco's ips portfolio and Sourcefire's I think this is simply Cisco buying a competitor out. Once the contracts expire expect snort to disappear and those customers get pushed to Cisco's products.
^^^ What William said. I am happy for little man getting paid but tired of big companies buying out GPL software and making it closed source or worse just killing the project. Lets see if astaro stays with their original philosopy of staying with open source like Suricata or we go closed source and sophos develops their own IDS engine for the UTM... I think it would be the latter.
