Re: [cti] Top-Level Object Properties

["Barnum, Sean D." <sbarnum@mitre.org>]

I would concur with defining normative text for the proposals but would strongly disagree with putting this in the pre-draft spec.

I believe that only consensus content should go into any spec docs (pre-draft, draft or otherwise). There is an inherent bias applied to anything placed in a “spec” document.

We should discuss, debate and decide on consensus (which should include normative text) before it goes in an actual “spec” doc.

sean

From: <cti@lists.oasis-open.org> on behalf of "ppatrick@isightpartners.com" <ppatrick@isightpartners.com>
Date: Thursday, February 4, 2016 at 10:04 AM
To: "cti@lists.oasis-open.org" <cti@lists.oasis-open.org>
Subject: Re: [cti] Top-Level Object Properties

+1 with Mark’s comment.

I don’t care as much if its in the STIX pre-draft document or not, but without something concrete to comment on as its gets really hard to comment on and follow.  Seeing the Node and field description with normative text certainly makes it easier to make specific comments

Paul Patrick

Chief Architect

iSIGHT Partners

From: <cti@lists.oasis-open.org> on behalf of Mark Davidson <mdavidson@soltra.com>
Date: Thursday, February 4, 2016 at 6:40 AM
To: "Wunder, John A." <jwunder@mitre.org>, "Jordan, Bret" <bret.jordan@bluecoat.com>, "Piazza, Rich" <rpiazza@mitre.org>
Cc: "cti@lists.oasis-open.org" <cti@lists.oasis-open.org>
Subject: Re: [cti] Top-Level Object Properties

It would be much easier for me to comment on these topics if we had them in a living document and had the non-consensus items identified in some way (e.g., highlighted text). My opinion of certain fields will depend more on the normative text that surrounds them than the concept of them. 

I’ve moved some text from the TWIGs document to the STIX pre-draft document [1] under the heading “Common Object Properties” and attempted to follow my own advice; non-consensus items are highlighted in yellow. I know we talked about doing this on the wiki, but the wiki makes my brain hurt and scream out for a better way of organizing the information (Does anyone else get the same thing? If it’s just me I’ll go along with the wiki). 

Thank you.

-Mark

[1] https://docs.google.com/document/d/1U48DOJzh2qELOEhhVWz_G6hL0Bazx1Y52wpOeR8jaVk/edit#