Re: [EXT] Re: [cti-stix] RE: [Non-DoD Source] [cti-stix] Eight Arguments

Yes, we should do that John-Mark. Lets walk carefully here. Lets look at what we have, how things are working (now that we are starting to get running code), and review and make changes where necessary. If we need to make a change in any part of the spec, because we got something wrong, NOW is the time to do it. Not 6-12-18-24 months from now. Given how much is in 2.0 and how few problems we have seen in implementation, I consider that a massive success. Personally I am not worried or scared about having a few breaking changes 2.1, we kind of knew that might happen. And finding them now means that people are trying to implement STIX 2, and that is a brilliant thing. These are good problems to have, because that means people care and are looking at adopting our work.

All in all, I think we know and understand the problem with implementing STIX 2 so much more now. And yes, I am sure we will find more than one thing we need to fix/undo/change. But that does not mean the whole thing is wrong, not at all. We got sooooo much right.

Example: We had a large debate the ID format of type--uuid, and I can now say for sure that having that makes your code so much easier. Having that hint about the type in the ID really saves you a lot of pain.

Bret

From: cti-stix@lists.oasis-open.org <cti-stix@lists.oasis-open.org> on behalf of John-Mark Gurney <jmg@newcontext.com>
Sent: Monday, November 13, 2017 5:43:43 PM
To: Katz, Gary CTR DC3\DCCI
Cc: JG on CTI-TC; cti-stix@lists.oasis-open.org
Subject: [EXT] Re: [cti-stix] RE: [Non-DoD Source] [cti-stix] Eight Arguments for an Infrastructure SDO for STIX 2.1

Katz, Gary CTR DC3\DCCI wrote this message on Mon, Nov 13, 2017 at 20:09 +0000:
> Option 3: Make Cyber Observables Top Level Objects

What would this look like?

I'm a bit curious because w/o the time information, you'd just need up
w/ an IP object or a DNS query object, which with out context doesn't
seem useful. Most objects can on their own convey some information w/o
having to resolve references.

Can you at least give me a sample of what a cyber observable as a TLO
would look like?

Thanks.

--
John-Mark

---------------------------------------------------------------------
To unsubscribe from this mail list, you must leave the OASIS TC that
generates this mail. Follow this link to all your TCs in OASIS at:
https://clicktime.symantec.com/a/1/pdCDKqBMpjSt4T90hRjMDE6K4ZNpzkXLvMJOWFqBqGg=?d=qT9BK27EohL2mEbvr1juMtuH40JCqKC8GytO0vphQXeWo2GJlczdf8lpTUXoKZwuvXAYWwrcMYo9an0vMbefWMtFLRr2_IqH94xozMjpB22JFo8O-7cVNrPIoWwp6-rgr2ongYOQCICMPXbOlszvY_q9LJ0VKnBB4ya4WWB8KiXIrjPTJG7Qbb971uvs0p4aVs8Sz4JeOif091Rvx8GUu9eaIARXF9ns4Y52UhaCciE_c5tW5ZDmx1NPzPooywVCHT1YMCGbuudUsXNYnNktqyOH2iinB11YViGFP_2E5IWFK-qAHA7JZTNt8e4OlyTyNSauxmEhPVbryPBn9BLdkpc2N5WyiEs0Cio28cBe76av4hTYHaiBFYgWeOU1CtLfkzBwrkhg5zM6KlP0jiSN-E-UqTJceARFtjAeADalFCp_k8pbStVvInoqE3CGyVwz8vFN0oDJNRJm_fzcPde4nJ3-l87o9NyojI3sNFjPYdyAoS79Oh92Xl0qU3KiPoI5&u=https%3A%2F%2Fwww.oasis-open.org%2Fapps%2Forg%2Fworkgroup%2Fportal%2Fmy_workgroups.php

cti-stix message