Jaap Keuter wrote:
I'm very much opposed to it. Boolean logic can be a somewhat tricky, but
when you master the math it becomes a powerful tool.
(Actually, it's more like propositional calculus vs. predicate calculus;
a filter expression "{field} {comparison} {value}" means
there exists an instance of {field} such that {value of that instance}
{comparison} {value}
and the negation of that isn't
there exists an instance of {field} such that {value of that instance}
{not-comparison} {value}
which would be
{field} {not-comparison} {value}
isn't the negation, the negation is
for all instances of {field}, {value of that instance} {not-comparison}
{value}
which would be
!({field} {comparison} {value})
.)
But, yes, special-casing some fields would, I think, be the wrong answer.
I think a better answer might be to add syntax similar to capture
fiters, so that if you want all packets to or from "foo", you can say
"host foo" for which the negation is more obviously "not host foo".
