Identifier Proposal Ballot

Dear CTI and CTI-STIX,

My apologies for the cross-post, but we have had more than one comment on the Identifier Proposal ballot that indicates people might be confused by the ballot language. In an effort to clear up any potential misunderstanding, I want to be sure that people understand what voting Yes or No was meant to mean while there is still a day left to vote or change your vote.

The ballot question (“Should we use UUIDv4 as our default format for identifiers?”) was not as clear as it could have been – in hindsight, I should have used another word besides “default”. If you read the description of the ballot, you will notice that the language in question specifically forbids the use of another UUID version such as 3 or 5. In essence, with the consensus language being considered, UUIDv4 would our “one and only” format for identifiers. Pat Maroney, Jeff Mates, Sean Barnum, and Paul Patrick have all written comments on the ballot that I recommend you read.

As referenced in the ballot, this was debated at length in the “Deterministic IDs - pas de deux” thread on cti-stix which you can view and search here: http://markmail.org/search/?q=%22pas+de+deux%22&q=list%3Aorg.oasis-open.lists.cti-stix#query:%22pas%20de%20deux%22%20list%3Aorg.oasis-open.lists.cti-stix%20order%3Adate-forward+page:1+state:facets

The key issue at question here is regarding deterministic IDs, which are enabled by UUIDv5.

· Pat Maroney, Paul Patrick and other prominent members of our community have articulated the benefit of allowing other versions of UUIDs as identifiers.

o They believe (and I would agree) that the consensus on using UUIDs as our object IDs at the January Face-to-Face (F2F) was based solely on the requirement that IDs be unique.

· Bret Jordan, John Wunder and others have expressed their concerns about how useful deterministic IDs will be with STIX given the potential lack of immutable fields that are required for generating a UUIDv5 guid.

· There is also a concern that there may be a difficulty with our proposed method of versioning if we allow for deterministic IDs. This point in particular has been debated extensively in the “Deterministic IDs - pas de deux” thread.

· Other members of the community have suggested optional fields in place of a deterministic ID that can fulfill the same functions as the use cases enabled by UUIDv5.

My sincere apologies for any confusion this may have caused. If you have any questions or concerns, please reach out to the co-chairs at cti-committee-chairs@lists.oasis-open.org. If you feel you have been misquoted, please correct me.

There are still eighteen voting members who are eligible to vote who have not. If you would like to vote or change your vote, please do so here: https://www.oasis-open.org/apps/org/workgroup/cti/ballot.php?id=2932

Alex Foley

CTI Secretary

cti-stix message