Re: Custom properties

That RFC is pretty clear. "X-" is so 1990s.

Why can't we have a registry? It could be as simple as a shared GitHub repository, which would have the advantage of version control. "Official" properties would probably be voted in, but it's easy enough to show the status of a property. Also, rather than spamming the list, someone could submit a Pull Request, which is much more developer-friendly and traceable.

</end 2cents>

JSA

From: cti-stix@lists.oasis-open.org <cti-stix@lists.oasis-open.org> on behalf of Wunder, John A. <jwunder@mitre.org>
Sent: Thursday, May 12, 2016 12:37 PM
To: cti-stix@lists.oasis-open.org
Subject: [cti-stix] Custom properties

Hey everyone,

As you know, custom properties is currently moving the approval process (text: https://docs.google.com/document/d/1HJqhvzO35h62gQGPvghVRIAtQrZn3_J__0UcDAj-NXY/edit#heading=h.8072zpptza86). We’ve had a couple objections, from Mark Davidson and Eric Burger, to the use of the x_ prefix. Mark pointed us to https://tools.ietf.org/html/rfc6648

My questions are:

- Should we proceed as is and have a ballot on the current approach?

- Should we just remove the SHOULD statement that recommends the x_ prefix?

- Should we take things back to the drawing board and talk about running a property registry as indicated by RFC 6648?

My opinion: at this point in our lifecycle as a community, we probably aren’t ready for a registry. We can use the informal process we talked about on the working call, where people can e-mail the cti-users list if there’s a property they want to make heavy use of. When we release a new version, if we want to move that to a standard we can have non-normative text deprecating the previous custom property and indicating that the new standards-based property should be used. I could go either way on keeping the SHOULD requirement for the x_ prefix, but given we’ve had strong agreement to keep it over previous calls I’m feeling like we should keep it as is.

Given that, I would like to proceed with the ballot either today or later tomorrow. Just wanted to call out this important topic though.

John

cti-stix message