[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]
Subject: Re: [cti] TAXII
+1 on ‘if we are going to re-open things up then we should consider alternative proposals from across the community and do a formal review of both requirements, pros/cons of each approach
and then choose as a community which path is best. However… We should not re-open things up. TAXII 2.0 is fairly close and despite it not being perfect; it is a good step forward towards a mechanism to share STIX content. Will it be the only mechanism to share STIX 2.0 content. Absolutely not.
XMPP, Email, FTP, SSH….etc are all protocols that could and will be used for conveyance of STIX content. Lets finish TAXII 2.0 and get some interoperability on it before we start consider alternatives. Allan From:
"cti@lists.oasis-open.org" <cti@lists.oasis-open.org> on behalf of Jason Keirstead <Jason.Keirstead@ca.ibm.com> Hello all - I have been making numerous arguments against this JSON-API proposal on Slack, but figured I had better send them to the mailing list as the whole TC does not monitor Slack. - First, let me preface this by saying personally I do not agree at all with how this proposal has come about. We have been working on TAXII 2 as a community for over a year, and many, many
TC members have contributed to it. To come in at the RC stage with an "out-of-the-blue" ground-up re-proposal is far from ideal. It is in my opinion very hard to consider a proposal solely on its merits with timing such as this. - In my opinion, in order to make an argument to re-visit all of TAXII at this late stage, one should have a compelling set of reasons for this re-visit - ie a list of problems that exist
in the RC proposal that either do not exist or are solved in the new proposal. There is no such set of reasons presented here - it is simply a ground-up re-think with no compelling arguments presented as to why it is superior to the current RC TAXII proposal.
As such, to me this JSON-API proposal to me is very much a solution in search of a problem... what are the specific problems it is solving? - The new JSON-API based proposal is **extremely verbose**. It is difficult to put an exact number on the "data bloat" occurring here, but I would conservatively place it at around 10x vs.
the RC1 proposal. We must keep in mind that most vendors are potentially dealing with extremely large data set sizes when it comes to CTI production and consumption, and size matters - both on the wire, and in memory, and at parse time. The argument "CPU/Memory/Disk
is cheap" does not hold water in the world of big data. Data size still matters. In return for this data bloat, I would hope that this proposal came with a large set of concrete benefits, but I don't see them. - Finally - If we were actually going to re-open everything and spend another 3/6/9/12 months on TAXII 2, then I would humbly also request time to submit a proposal for OData as well - http://www.odata.org/ -
as this is an existing OASIS standard developed over a long period of time, and backs large scale enterprise services already, so I have a lot more confidence in it than JSON-API for our use cases, and it would also give us TAXII Query as well as many other
capabilities out of the box. -
|
[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]