Chatting with folks on Kolide Slack, we were talking about some of the ways we add some complexity when working cross platform. It's pretty common for us to get information from different places. On windows, we often need kolide_wmi or registry, while on macOS it's often an exec and plist parse.
That works out okay if we're making a check per platform. But sometimes we really want to make a single check. And this effort is stymied by the platform specificity of the tables. Because kolide_wmi is not available everywhere, it cannot easily appear in non-windows SQL. If it was a legal table, that returned nothing, we'd have more rope around CTEs and sql.
Downside, is that if you were querying a non-platform table, there'd be no feedback about what you were doing wrong. But maybe that's a place for logging.
Chatting with folks on Kolide Slack, we were talking about some of the ways we add some complexity when working cross platform. It's pretty common for us to get information from different places. On windows, we often need
kolide_wmi
orregistry
, while on macOS it's often an exec and plist parse.That works out okay if we're making a check per platform. But sometimes we really want to make a single check. And this effort is stymied by the platform specificity of the tables. Because
kolide_wmi
is not available everywhere, it cannot easily appear in non-windows SQL. If it was a legal table, that returned nothing, we'd have more rope around CTEs and sql.Downside, is that if you were querying a non-platform table, there'd be no feedback about what you were doing wrong. But maybe that's a place for logging.