Re: [cti-cybox] Recent CybOX Changes

[Allan Thomson <athomson@lookingglasscyber.com>]

That’s a good clarification and it makes me wonder why this attribute needs to be conveyed at all. What is a recipient expected to do with this information?

Certainly combining it into a single field makes no sense now.

Thanks for sharing this perspective. It changes my opinion of what this encoding field is attempting to convey and how it should be done.

allan

On 8/2/16, 10:47 AM, "John-Mark Gurney" <jmg@newcontext.com> wrote:

    Allan Thomson wrote this message on Tue, Aug 02, 2016 at 14:02 +0000:
    > Finally, *if* encoding must be conveyed when a field that may have different encodings possible is required. Then what is the most efficient and effective way to allow two systems to a) generate that package b) read that package efficiently and effectively.

    I want to clarify this statement..  Fields only ever contain Unicode
    data.  They never contain non-Unicode, or encoded data..  The encoding
    is a way to convey what encoding the original data had before converting
    to CybOX.

    --
    John-Mark