That’s a great real-world story. Exactly the kind of unexpected modification FIM can help surface—not only security incidents, but also operational surprises.
Compliance is definitely one use case, but not the only one. It’s also useful for catching unexpected local changes in real-world operations. The goal is to provide a lightweight FIM that can be added to existing apps without too much friction.
You’re right that this doesn’t prevent compromise—it’s a detection control, not prevention. Things like read-only mounts or immutable bits are great, but in practice issues like command injection or misconfigured deployments still happen. FIM helps you know when files were changed and provides evidence for investigation or compliance.
I was thinking about whether to return an error. If we can’t find a UTF-8 start byte in the nearby 4 bytes, it’s unclear what to return. I thought maybe we could ignore this problem.
I don’t return the string itself because I don’t know if users want the start or the end of the string. Also, I want to avoid copying large strings. It’s up to the users how they use this function.
Since no one is using this package yet, we might consider changing the interface.
Thank you for your feedback. The current implementation of purl uses Go's regexp package for regex operations, which ensures consistent behavior across platforms. I acknowledge the README does not specify this yet, and I plan to update it to clarify the regex implementation used.
Thank you for trying out purl! Currently, the file name needs to be placed at the end of the command like this: purl -filter func main.go. This format helps purl understand which part of the command specifies the options and which part specifies the file.
I appreciate your feedback and understand that a more flexible command structure might be easier for users. We will consider making this change in future versions to accommodate different usage preferences.
Thank you for the congratulations! Currently, purl does not include features similar to AWK. We appreciate your suggestion and will consider it for future development.
My message is in the public archive here: https://yhbt.net/unicorn-public/20251227071714.D9328160070@m...