Re: [cti-stix] Kill Chains in STIX

[Allan Thomson <athomson@lookingglasscyber.com>]

I think we are discussing trade-offs that impact products creating or using STIX.

I personally much prefer lower case for all terms but that’s not the point of deciding case sensitive or not.

I think you should also consider the users of our products in this.

A user will not know which case the STIX spec defined the terms in and products that expose these terms in their UI will have to support case insensitive searching/use.

Users will just type what they think the term is without regard to uppercase, lowercase, camel-case ….etc.

By making terms case sensitive in the protocol exchange you are forcing products to know what the exact case was used in the spec, and then products will have to know how to map from what users do to the underlying protocol uses.

For me, not having to care about case sensitivity if a user enters a term of an open vocab in all CAPS when the spec was defined in lowercase then that would be a good thing.

I also think for open vocabs products will have to support the option to extend the vocab and therefore unless you are careful you could end up with multiple versions of the same term just because the user’s entered the term using different cases.

For example, all of the following are clearly the same term:

THREAT-BLAH
Threat-Blah
threat-blah
threat-Blah
threat-BLAH

….etc.

Allan

On 6/7/16, 4:53 PM, "John-Mark Gurney" <jmg@newcontext.com> wrote:

>Jason Keirstead wrote this message on Tue, Jun 07, 2016 at 09:04 -0300:
>> I would vastly prefer that the standard declares that vocabularies are
>> case-sensitive. If vocabularies are case-insensitive it is a headache. Note
>> that I am *not* saying that I think that we should mandate that entries all
>> be lower-case - I am saying that we should mandate that the vocabulary is
>> case-sensitive and compares should be done that way.
>
>I agree...  Trying to do case insensitive compares intorduces complexities
>that case sensitive does not..  Simple ==/strcmp for most uses...
>
>--
>John-Mark