Re: [cti-stix] version

This to me is useful internally as part of the workflow, but isn't that useful as part of something being shared. A computer will be able to discern what has changed in the object when it was updated, so this field only repeats that in human terms - which the recipients implementation would be able to do anyway.

On 4/08/2016 4:02 AM, "Jordan, Bret" <bret.jordan@bluecoat.com> wrote:

It feels very 'git commit -m "some comment"' like. I see the value in understanding why a new version was created.... I get that.. But I worry that in practice no one or no TIP will actually use it. So the questions I have are:
1) are we creating something that would be a nice to have?
2) are we creating something that "if we build it they will use it"?
3) are we creating something that is needed / demanded by the TIP vendors today?
4) is there any TIP vendor doing something like this today?

Side note: if we are following the "if we build it they will use it" philosophy, then there are probably a few other things we should add as well.

Thanks,

Bret

Bret Jordan CISSP
Director of Security Architecture and Standards | Office of the CTO
Blue Coat Systems
PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050
"Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg."

On Aug 3, 2016, at 06:56, Wunder, John A. <jwunder@mitre.org> wrote:

Hey everyone,

Back when we talked about versioning at the DC3 F2F, one of the properties we added to STIX Object common properties was “version_comment”. The intent was to allow people to add a comment saying why they created a particular version (e.g. “fixed a typo” or “corrected domain” or something like that). The property is optional on all STIX Objects.

As we’ve been going through the properties though we started to wonder if version_comment would really be used in practice. Is that something that existing TIPS and other tools actually populate? Or would populate if they had such a field? We want to be careful not to add fields just because we think they might be useful…it’s easy enough to add things in 2.1 if we find we need them, it’s a lot harder to take things away.

So what do you think? Should we keep the version_comment field for STIX 2.0?

Thanks,
John

cti-stix message