vipyrsec / dragonfly-mainframe

The mainframe for Dragonfly
https://docs.vipyrsec.com/dragonfly-mainframe/
MIT License
5 stars 1 forks source link

FEAT: Live streaming of package scan information #260

Closed Robin5605 closed 1 month ago

Robin5605 commented 3 months ago

I believe that it's worthwhile to discuss if we should implement a live flow of package scan information from Mainframe to consumers, rather than having consumers poll. This will allow us to centralize the classification of malicious and non-malicious packages, rather than relying on consumers to do that themselves.

There are probably many ways to go about implementing this, but websockets might be the simplest, but we can also look into a pub/sub messaging system.

I'd also like to discuss how authentication would be done, if we settle with websockets. Websockets are fundamentally different from HTTP in that it's a stateful protocol, and the authentication scheme we have now is designed for stateless protocols, like HTTP

import-pandas-as-numpy commented 3 months ago

Maintaining a persistent connection to our services seems incredibly tedious for very little gain-- I can see benefits in the use of a message queue in this regard, but I think Websockets are heavy handed here.

Keep in mind there is no actual requirement for 'real time' feedback from the queue, polling on an interval is a graceful solution to this regardless of how we go forward.

In the absence of any requirement for real time feedback, the only rational solution to defer detection and filtering out of the bot is a message queue IMO.