Re: [cti-cybox] Recent CybOX Changes

[John-Mark Gurney <jmg@newcontext.com>]

Kirillov, Ivan A. wrote this message on Mon, Aug 01, 2016 at 18:16 +0000:
> Also, Trey, Allan, and I briefly talked about this earlier today and we thought it might be better to remove the “OR” between string and string-with-encoding-type in those instances where we thought observed encoding could be captured, and instead just force those fields to use string-with-encoding-type. This means that you’ll always specify and parse those fields as an object, leading to less branches in your code. We’ve made this change in the CybOX Objects – let us know what you think (is it an improvement?). 

It is better to always use one object instead of an or... But I still
prefer using the _enc field, as flatter is better.. :)

> As far as file path, are there other thoughts on this as far as the preferable approach (single string vs. list of path component strings)? Trey and I are a little hesitant to change our current implementation because it seemed like we had consensus on this when we were creating and reviewing the File Object. That said, if the group feels that having a single string for representation of file paths is enough, we’ll be happy to go in that direction.

I disagree w/ using string-with-encoding-type for the file-path-type...
The entire path will will be a single encoding... Each segment of the
path will not have a different encoding..  IMO, right now it's ridiculous:
{ "delimiter": "/",
  "components": [
	{ "value": "opt",
	  "encoding": "ISO-8859-15"
	},
	{ "value": "local",
	  "encoding": "ISO-8859-15"
	},
	{ "value": "Library",
	  "encoding": "ISO-8859-15"
	},
	{ "value": "Frameworks",
	  "encoding": "ISO-8859-15"
	},
	{ "value": "Python.framekwork",
	  "encoding": "ISO-8859-15"
	},
	{ "value": "Versions",
	  "encoding": "ISO-8859-15"
	},
	{ "value": "2.7",
	  "encoding": "ISO-8859-15"
	},
	{ "value": "lib",
	  "encoding": "ISO-8859-15"
	},
	{ "value": "python2.7",
	  "encoding": "ISO-8859-15"
	},
	{ "value": "site-packages",
	  "encoding": "ISO-8859-15"
	},
	{ "value": "Crypto",
	  "encoding": "ISO-8859-15"
	},
	{ "value": "__init__.pyc",
	  "encoding": "ISO-8859-15"
	}
	]
}

vs:
{ "delimiter": "/",
  "components": [ "opt",
		"local",
		"Library",
		"Frameworks",
		"Python.framekwork",
		"Versions",
		"2.7",
		"lib",
		"python2.7",
		"site-packages",
		"Crypto",
		"__init__.pyc" ],
  "components_enc": "ISO-8859-15"
}

-- 
John-Mark