Re: [cti] CybOX Datatype Refactoring/Deprecation

[Trey Darley <trey@soltra.com>]

On 23.02.2016 02:38:05, Foley, Alexander - GIS wrote:
> 
> While I totally agree that the standard is what Terry and Rob say
> (with slight variations, as Outlook doesn't require hxxp or brackets
> around every [.] to defang a link), we've spent the last six months
> figuring out the caveats to the standard. For example, take our
> domain and URI regexes:
> 
> 
> *        Domains (did you know .homedepot is a gTLD? Neither did I
> *        until we had to write a regex to find it)
> 

As a technical sidebar, parsing URLs via regex is a losing game,
between the constant churn of new TLDs and dealing with non-Roman
scripts. A former colleague of mine maintains the faup [0] library
("Finally a URL Parser") that reliably parses *all* URLs and
normalizes their component fields into JSON. You should check it out!

[0]: https://github.com/stricaud/faup/blob/master/README.md

-- 
Cheers,
Trey
--
Trey Darley
Senior Security Engineer
4DAA 0A88 34BC 27C9 FD2B  A97E D3C6 5C74 0FB7 E430
Soltra | An FS-ISAC & DTCC Company
www.soltra.com
--
"It is always possible to add another level of indirection." --RFC 1925

Attachment: signature.asc
Description: PGP signature