Re: [cti-stix] Re: [cti-users] Indicator Type / Vocabulary Implementation Questions

[John-Mark Gurney <jmg@newcontext.com>]

On Fri, Oct 23, 2015 at 7:42 AM, Jason Keirstead <Jason.Keirstead@ca.ibm.com> wrote:

The twofold problem with this approach however is what I mentioned previously

- Many STIX consuming systems do not have internet access, and thus can not download arbitrary vocabularies created by others

- Entities producing STIX documents may also not have any access to a reasonable place to post a vocabulary for the public.

The tool doesn't need access to the vocabulary to use the document.  Yes, the tool might not know if the string is valid, but that doesn't mean that the tool cannot still use the document.  I would also hope that you trust who ever is producing and providing the document in these cases.

I will admit I haven't figured out how hard it is for validating XML parsers to selectively ignore this error.