Re: [cti-stix] Object ID format

[Eric Burger <Eric.Burger@georgetown.edu>]

The content may be relevant, current, and not at the URL published in the STIX document. For example, something could have a URI pointing to redcliffconsulting.com. Oops, that is mandiant.com. Oops, that is fireeye.com. So, the data might be important, available, but not at the same URI it lived at when it was published.

That is why URI’s are either URL’s (with the location) and URN’s (just the name). I could see where we just specify STIX includes a URI, and the choice of a URL or URN is up to the sharing community. I could see large, long-lived communities standing up a URN directory resolver. I could see ad hoc and smaller communities leverage the ease of a URL.

I.e., let’s have our cake and eat it too. Note this does not violate Eric’s Law™: pick one and only one way of doing something. The one and only one way is a URI. It just happens the URI can be a URN.

> On Jan 24, 2016, at 9:35 PM, John Anderson <janderson@soltra.com> wrote:
> 
> True, content does disappear from the Internet sometimes. Sometimes that's a good thing. Other times, how does the web handle that? I can think of three ways:
> 
> 1. Responsible redirects. (When the purchasing company cares about the content it's moving.)
> 2. Google. (When other people who link to the content care about its new location.)
> 3. Wayback machine. (When...?)
> 
> I wonder how CTI is different from web documents. I mean: If the content is not worth the effort to maintain, why do I care if I can't find it anymore?

Attachment: smime.p7s
Description: S/MIME cryptographic signature