Channels
  • t

    Ted Dorosheff

    4 months ago
    question about file carver:
    carver_disable_function
    and
    disable_carver
    both default to true. What happens if you set one to false? What is the difference between the two flags?
  • zwass

    zwass

    4 months ago
    heh, this was one I was wondering about recently 😅 let me see if I can dig up the thread
    Ah, there's no thread but https://github.com/fleetdm/fleet/blob/a7aa14fa7604b8ab503d326a10c7188ef6312e58/orbit/pkg/osquery/flags.go#L30-L32
    This "double-negative"
    --disable-foo=false
    is unfortunately common in osquery... IIRC it's due to something with the way that gflags (our flag parsing library) handles default values.