Re: [csaf] CVSS v2/v3 use in CVRF 1.2

[Patrick Maroney <pmaroney@wapacklabs.com>]

Re: "Before voting can we have an opportunity to discuss? I am not sure everyone is aware of the consequences of the various options."

I think Harold raises a good point.  It's important those voting on a formal ballot understand the ramifications of their decision.

I'm not familiar enough with all of the practical implementation details, but want to pose the following question:

In the CTI TC community we've faced similar issues with backwards compatibility (and about to face a major challenge in the XML => JSON MTI transition).  MITRE was engaged to develop conversion/validation scripts.  This provided a "clean" method to convert legacy STIX documents to the current version.  If you still have "old" operational tooling (or legacy data files) you can add an automated process to upgrade your content.  It only works in one direction of course and you may have to manually deal with outliers/special cases.

Would this be a viable approach here as well?

Patrick Maroney

Principle Engineer - Data Science & Analytics

Wapack Labs

On Apr 4, 2017, at 4:19 PM, Booth, Harold (Fed) <harold.booth@nist.gov> wrote:

Before voting can we have an opportunity to discuss? I am not sure everyone is aware of the consequences of the various options.