https://github.com/osquery/osquery logo
#core
Title
# core
t

tde

06/17/2018, 9:30 PM
@Matt Lehman We looked into using 0MQ for a bit for agent IPC for a different project. One frustrating limitation is no named pipe support on Windows. And no Go support without cgo.
m

Matt Lehman

06/17/2018, 9:33 PM
I didn’t realize the windows named pipe piece. That stinks. Seems like there is some beta pure Go stuff here: https://github.com/zeromq/gomq/blob/master/README.md
Apparently for the windows work around people use it in TCP mode on localhost. Several claims that the performance hit is very minimal but I haven’t done this myself.
t

tde

06/17/2018, 9:42 PM
Yeah, you can do local TCP, but you can't add security descriptors to it, which may or may not matter, depending on your scenario. Means another low-priv process could mess with you.
2 Views