Opinion against 'update file' in slpf profile

[<duncan@sfractal.com>]

"+1" to including everything in slpf (ie no generic profile until we have more profiles to pick commonality from).

"minus infinity" to including 'update file' in slpf profile.

Is there a use case for 'update file' in slpf? The only slpf use cases I know of are for AWS NACL's (by sFractal and by AT&T) which does not support the concept of 'files' in the actuator. I am against including commands that break the only use cases we have. I'm marginally ok with including ''update file'' as an optional command if someone has a usecase for some slpf device that actually needs it.

Duncan Sparrell

sFractal Consulting LLC

iPhone, iTypo, iApologize

I welcome VSRE emails. Learn more at http://vsre.info/

-------- Original Message --------
Subject: [openc2-actuator] RE: [Non-DoD Source] Re: [openc2-actuator]
SLPF: 'Generic' commands
From: "Brule, Joseph M" <jmbrule@radium.ncsc.mil>
Date: Mon, June 25, 2018 9:31 am
To: dave.lemire <dave.lemire@g2-inc.com>
Cc: "openc2-actuator@lists.oasis-open.org"
<openc2-actuator@lists.oasis-open.org>

+1 @ Dave Lemire. 

 

THIS PART IS MY OPINION ONLY;  The notion of a ‘generic’ or ‘common’ profile that everyone and their pet dog needs to import is a reasonable idea, but until we get a few profiles underway, I think identification of the ‘generic commands’ will be based on guesswork rather than analysis. END MY OPINION

 

For now, can we put the ‘update file’ command in the SLPF?  We are still in the draft phase of the profile (and lang spec for that matter) so will have an opportunity to revisit. 

 

VR

 

Joe B

 

From: Dave Lemire <dave.lemire@g2-inc.com>
Sent: Monday, June 25, 2018 9:21 AM
To: Brule, Joseph M <jmbrule@radium.ncsc.mil>
Cc: openc2-actuator@lists.oasis-open.org
Subject: [Non-DoD Source] Re: [openc2-actuator] SLPF: 'Generic' commands

 

I concur. At this stage of the same, I think every AP needs to be a self-sufficient document, and we should accept that the v1.0 L-Spec is going to have little or nothing for a generic profile because we don't have enough experience or information. Maybe there can be a v1.1 or v1.5 L-Spec that adds a generic profile to the v1.0 Language along with no other changes other than possible errata. 

 

Dave

 

David P. Lemire, CISSP
  OpenC2 Technical Committee Executive Secretary
  OpenC2 Implementation Considerations SC Co-chair
  Contractor support to NSA
Email: dave.lemire@g2-inc.com
Office: 301-575-5190 / Mobile: 240-938-9350

 

On Fri, Jun 22, 2018 at 3:36 PM, Brule, Joseph M <jmbrule@radium.ncsc.mil> wrote:

BACKGROUND: 
Early in the profile development, the subcommittee adopted a bottoms up approach where the profiles would be 'complete' and as time progresses, we would define the 'generic' profile on analysis of existing profiles.
Later it was decide that the SLPF would be a 'specialized' profile and it would refer to a generic profile for more general commands
Post CSD 1, we have a specialized profile, but we do not have a generic profile to refer to and the Language SC has a comment along the lines of removing the generic profile section from the language specification

ISSUE:  A 'specialized' profile w/o a generic profile to reference is untenable.

RESOLUTION:  In the interest of having a workable profile, suggest putting the command 'update file' in the SLPF profile. 

VR

Joe Brule





---------------------------------------------------------------------
To unsubscribe from this mail list, you must leave the OASIS TC that
generates this mail.  Follow this link to all your TCs in OASIS at:
https://www.oasis-open.org/apps/org/workgroup/portal/my_workgroups.php