marpaia

I use cobra sometimes, it's not that cobra or mow is too heavy, but I think that the oklog-style command parsing pattern is no more code or boiler-plate than using a library (for many use-cases) and it reduces developer overhead because most people are already familiar with how `flag` works. The whole pattern is really just the normal `flag` library and a switch statement, but it works really nicely because `flag` is really great and has a lot of features.

Kolide | C++ Software Engineer on osquery | Fully Remote | Fulltime | https://kolide.com/osquery

Hey there! Mike Arpaia here, a Co-Founder of a host endpoint company called Kolide (https://kolide.com) and the original creator of the open-source security software osquery (https://github.com/facebook/osquery) which I put together as a solution to Facebook's HIDS problem when I worked there as an engineer.

Kolide is building a team of software engineers to work on and contribute to the osquery codebase, which is an open-source C++ project. Open sourced by Facebook in 2014, osquery is an operating system instrumentation and analysis framework which solves a variety of monitoring and instrumentation use-cases. Since its release, osquery has become one of the most popular open source security software projects on all of GitHub with over 9,000 stars and 1,000 forks.

The osquery engineering team at Kolide, led by me, the progenitor of the osquery project, will focus on improving the open source codebase for all users of osquery. Engineers will work closely with members of the core osquery team, osquery community members, and other Kolide employees to prioritize features and collaborate on development. Due to the distributed nature of the osquery open source project, this is a completely remote role; Candidates should feel comfortable working independently in a distributed fashion.

The following attributes would be true of an ideal candidate:

- Extensive experience writing C++

- Deep knowledge of the operating system internals of macOS, Linux or Windows

- A passion for open source software and community

- Strong writing skills and the ability to express ideas via project proposals and design documents

- Previous contributions to osquery are definitely a plus, but not strictly required

If this sounds interesting to you, shoot me an email at mike@kolide.com!

Hmn, no, not really. there is no underlying datastore for the data that you query. it's all generated on the fly.

Right now osquery only supports read operations but you're totally right; if you could kick off tasks, kill processes, unload kexts, etc. via CREATE, DELETE, etc statements, that would be so killer!

The SQL engine part of osquery is backed by SQLite's parser, lexer, query planner, etc. MySQL would be awesome as well though, mostly because of how easy it might be to integrate the MySQL remote access protocol to do remotely authenticated queries!

Of course, it's an intuitive comparison to make. I'm glad you like it! I'm looking forward to working with you and similarly insightful community members on improving osquery for everyone :)

Yup! The only reason why it's not today is because we couldn't get a formula merged into mainline homebrew until the download link was public. It is now though, so we'll sort this out soon. Now that you mention it though, this would be a pretty easy, high-impact contribution that a community member could make as well!

Hey, Mike Arpaia here. You're totally right in that the SQL interface is very similar to WMI. Some core differences with osquery are:

- it's cross platform and supports many *nix operating systems

- adding new tables is very well supported via a simple API: https://github.com/facebook/osquery/wiki/creating-a-new-tabl...

- several tools and utilities exist to leverage the power of SQL at scale (osqueryd is a full operating system instrumentation tool which allows you to use SQL to instrument your whole infra): https://github.com/facebook/osquery/wiki/using-osqueryd

All in all, WMI is great, no doubt about it, but osquery has a few unique features which make it a cool, interesting product that you can use all across you internal infrastructure.