I think that deploying extensions is not a big issue; we had a cool PR that makes packaging configurable
10/23/2021, 8:01 PM
im not super familiar with packaging
but if an organization gets osquery from a vendor that organization will have to ask that vendor to include any additional extensions right?
organizations that manage their osquery instances and their own packaging can include anything they want yes
but if they get it from a vendor can they still include additional extensions?
an organization that gets it from a vendor that doesnt the extension the organization will need to do extra work to include it in packaging vs having it in core?
10/23/2021, 11:17 PM
They might have to ask the vendor if they want to embed additional things, or handle the deployment theirselves
osquery is a building block in the stack, I don't think it should include every possible functionality because company X does not want to ship an extension or vendor Y does not support it
I think it must be kept true to itself and follow its original use cases; new ones should be carefully evaluated before they are implemented, because there are many people using it for what it is today
Not having a company-wide plan to distribute extensions (and other software as well) is not a strong argument in itself to justify merging any kind of feature in core