when thinking about a new feature we usually go over the following points 1. How many dependencies is it adding? 2. What's the new attack surface? 3. Would this be possible to implement in an extension? What are the pros and the cons? 4. If it lands in core, what are the pros and the cons? 5. How easy it is to use it in the wrong way? 6. What's the worst that can happen (when used wrong)? 7. Does it fit into the osquery use case? EDIT: spelling