I’m not sure you’re going to get a better set of answers than you did in https://osquery.slack.com/archives/C08V7KTJB/p1581915978247200 While here, or #windows would have been more appropriate, it’s still the same people

Yeah, I understand. Thank you for giving opinions.

I’m not sure how many folks are still on the version 3 branch. A lot of focus is on v4.

Thank you for replying me 😆 Currently in linux side, I had build my own extension with osquery version 3.3.2 successfully. Now, I need to make things done in windows. So seems like in version 4.x, it's hard to build extensions

I thought the 4.1 line was pretty reasonable for extension building. But I work mostly in go, so it’s a different extension ecosystem.

i.e: I have tried the lastest version of osquery, and try to build the trailofbits extension, but seems like it don't build in the right way

Generally speaking, I think you should write extensions in whatever language you’re most comfortable in. In all cases, they will likely require some amount of work to get going the first time.

Woww, those are really nice documents. Thank you 😆

I suspect that people will help you get it built on v4. Mostly I think people should use the languages they know and like. ¯\_(ツ)_/¯

Wow yes, I really appreciate that. And it's glad to receive your quickly response. Your suggestions help me alot

I’m happy I can help a little.

By the way our extensions in the master branch target 3.3.2; also, last time we worked with the official osquery 3.3.2, it wasn't building properly. We have made a fork for that (osql) and other reasons. That been said I suggest too to use 4.x; you can have a look to what's needed here (https://github.com/trailofbits/osquery-extensions/pull/51), or if you simply want to build our extensions for 4.x

Let me summarize your ideas. If I want to build trailofbits extension with osquery version 4.x, I will need to cherry-picking all the commits in your link: https://github.com/trailofbits/osquery-extensions/pull/51 Am I right? Sorry because I'm still new with these awesome techniques

You don't need to cherry-pick, you can just fetch the branch where that PR is, which is local and which is named

extension_porting_4.0.1

(yay mismatched versions, but it has been a WIP for a bit).

So kinda I will need to fetch that branch to build trailofbit extension with osquery version 4.x.