Re: [cti-cybox] CybOX 3.0 Spec Review

[Trey Darley <trey@kingfisherops.com>]

On 25.07.2016 11:21:00, Alexandre Dulaunoy wrote:
>
> Thank you very much for your work on the CybOX specifications.
>

You're most welcome! ^_^

>
> Maybe we were not following all the discussions but we were
> wondering why indexed hash values are used instead of simple JSON
> arrays?
>

Indexed hash values were chosen as a mechanism for easy resolution of
CybOX relationships within a CybOX container.

>
> And with that choice in mind, why strings values are used?
>

String values were used because there were a number of SC members who
were adamant about being able to use arbitrary strings instead of
integers.

>
> In our eyes, it adds a lot of complexity in parsing. Maybe we don't
> get the reason in the first place but we wanted to be sure that is
> really intended.
>

The CybOX SC examined a number of alternative structures for the CybOX
Container and selected the simplest structure that supported CybOX's
use cases. Ivan and I have had something like 50+ hours of CybOX
working calls so far this month, during which this approach was
thoroughly discussed.

Given my history with parsing previous versions of CybOX, this is one
of my primary concerns in CybOX 3.0. When you say that this approach
"adds a lot of complexity in parsing", that raises red flags for me.
What do you see that the rest of us are missing, Alexandre? How would
you structure CybOX Containers?

-- 
Cheers,
Trey
++--------------------------------------------------------------------------++
Kingfisher Operations, sprl
gpg fingerprint: 85F3 5F54 4A2A B4CD 33C4  5B9B B30D DD6E 62C8 6C1D
++--------------------------------------------------------------------------++
--
"No matter how hard you try, you can't make a baby in much less than 9
months. Trying to speed this up *might* make it slower, but it won't
make it happen any quicker." --RFC 1925

Attachment: signature.asc
Description: Digital signature