Arne Welzel

Ouch, the change you reference also tanks runtime for the http_many pcap.  I guess switching to `.*` or possibly reverting seems reasonable.

> I suspect that the very long wildcard match constructs a very inefficient matcher. @vpax reply seemed to indicate this isn't surprising given the RE implementation. I'm closing this ticket,...

> This leads to packages relying on support files like random.seed or Scripts/canonify-zeek-log to be in this path to fail, I'm not sure the background, but discouraging packages from relying/re-using...

> input/ReaderBackend likely isn't used to dealing with a file.. not reading, so this likely triggered a codepath not often hit. Suspect it's @initconf doing something that no one else...

> For this to work for installed binaries we would need to embed changed ASAN defaults into all binaries we install (since -fsanitze=address is viral), e.g., [add the following](https://github.com/google/sanitizers/wiki/AddressSanitizerFlags#run-time-flags) to...

> it's definitely incorrect usage of the ternary operator. [...] I could see limiting it to constants and any container type. It's valid in other languages though. This already triggers...

> Long story short: it looks to me like val_to_data is dropping holes in vectors instead of mapping them to broker::none. Is this intentional or should we update the implementation?...

Can you see in how far or if this covers it? https://github.com/zeek/package-template/issues/11

> I was writing a btest for https://github.com/corelight/go-zeek-broker-ws and wanted to exercise every type the broker JSON encoding supports, but couldn't figure out how to create a null value in...

> AFAIK there is no broker JSON encoding for records. There is, it's just not explicit. I think you're in for a ride :-) Christian started a discussion here: https://github.com/zeek/zeek/discussions/2879...