Re: [cti-stix] Re: [EXT] Re: Bundle add Spec

As a followup to this discussion, there was a group that met on Friday to talk about this from a TAXII standpoint. The rough consensus out of that group right now is that TAXII should define its own Bundle / Envelope. This would solve some of the media type problems in TAXII and it would also eliminate the need for having spec_version on the STIX Bundle. Just FYI.

Obviously the TC as a whole will need to decide if these changes should be made to TAXII. Please see my mail to the taxii list from last Friday if you want to comment on this issue.

Bret

+1.

On the core question here...I think it's probably a good idea to add some spec_version field to bundle and make it mean just the spec version of the bundle. I'm pretty indifferent on the name, I'd lean towards just using spec_version (people will figure it out) but I'm fine with another name to deconflict as well.

John

-----Original Message-----
From: cti-stix@lists.oasis-open.org <cti-stix@lists.oasis-open.org> On Behalf Of Sean Barnum
Sent: Monday, September 24, 2018 9:38 AM
To: Trey Darley <trey@newcontext.com>; Bret Jordan <Bret_Jordan@symantec.com>
Cc: Jason Keirstead <Jason.Keirstead@ca.ibm.com>; drew.varner@ninefx.com; cti-stix@lists.oasis-open.org
Subject: Re: [cti-stix] Re: [EXT] Re: Bundle add Spec_version

+1

Sean Barnum
Principal Architect
FireEye
M: 703.473.8262
E: sean.barnum@fireeye.com

ïOn 9/24/18, 5:38 AM, "Trey Darley" <cti-stix@lists.oasis-open.org on behalf of trey@newcontext.com> wrote:

    On 21.09.2018 17:18:45, Bret Jordan wrote:
    > It seems like the easiest and simplest long-term solution that
    > ensures the most interoperability is for every object to just
    > include the spec_version that is complies with. This prevents
    > guessing and interpretation. It also ensures that things are done
    > right. The moment we do things like inherited versions under certain
    > conditions, someone is going to get it wrong in code.
    >

    Fully agree, Bret. We should keep spec_version on the STIX objects to
    avoid ambiguity.

    --
    Cheers,
    Trey
    ++--------------------------------------------------------------------------++
    Director of Standards Development, New Context
    gpg fingerprint: 3918 9D7E 50F5 088F 823F 018A 831A 270A 6C4F C338
    ++--------------------------------------------------------------------------++
    --
    "It ain't what you don't know that gets you into trouble. It's what
    you know for sure that just ain't so." --Mark Twain

This email and any attachments thereto may contain private, confidential, and/or privileged material for the sole use of the intended recipient. Any review, copying, or distribution of this email (or any attachments thereto) by others is strictly prohibited. If you are not the intended recipient, please contact the sender immediately and permanently delete the original and any copies of this email and any attachments thereto.

cti-stix message