Re: [cti] i18n (RE: MVP Discussion) - An Updated Proposal

[Mark Davidson <mdavidson@soltra.com>]

This is ultimately the question I think we need to ask: Are these two the same thing, or not? (pattern layer abstracted for example purposes):

Ex 1 -
{‘type’: ‘indicator’,
 ‘id’: ‘TBD’,
 ‘lang’: ‘us’,
 ‘title’: ‘some bad things to look for’,
 ‘ip-list’: [‘1.1.1.1’, ‘2.2.2.2’],
}


Ex 2 -
{‘type’: ‘indicator’,
 ‘id’: ‘TBD’,
 ‘lang’: ‘french’,
 ‘title’: ‘quelques mauvaises choses a rechercher’,  // translation provided by google
 ‘ip-list’: [‘1.1.1.1’, ‘2.2.2.2’],
}


Clearly not every field is the same (they differ in lang and title). However, I’d argue that the english version is 100% equal to:

<indicator id=“TBD” lang=“us”>
 <title>some bad things to look for</title>
 <ip>1.1.1.1</ip>
 <ip>2.2.2.2</ip>
</indicator>

I think really what we are getting at is “what are the rules for two TLOs being the same ID and revision”? I think they are the same even if they differ in serialization format (XML vs JSON).

If the two JSON examples are different, then they must be different object series (it doesn’t make sense for them to be revisions in the same object series). Therefore, one single “thing” will have as many object series as it has translation languages. To me it seems that this is a case of having two representations for the same thing.



Thank you.
-Mark



On 4/22/16, 11:23 AM, "Mates, Jeffrey CIV DC3/DCCI" <Jeffrey.Mates@dc3.mil> wrote:

>I'm not sure if I understand, are you proposing sending a second copy of the full object with the same ID and revision number with different content?
>
>If so I am strongly against it as I the translation object gives us everything this does and more without risking breaking some major backend components of STIX.
>
>
>Jeffrey Mates, Civ DC3/DCCI
>~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>Computer Scientist
>Defense Cyber Crime Institute
>jeffrey.mates@dc3.mil
>410-694-4335
>
>-----Original Message-----
>From: Mark Davidson [mailto:mdavidson@soltra.com] 
>Sent: Friday, April 22, 2016 11:12 AM
>To: Jordan, Bret
>Cc: Wunder, John A.; Masuoka, Ryusuke; Mates, Jeffrey CIV DC3/DCCI; cti@lists.oasis-open.org
>Subject: [Non-DoD Source] Re: [cti] i18n (RE: MVP Discussion) - An Updated Proposal
>
>I think different languages of the same indicator are not revisions of each other and are just different representations of the same resource.
>
>Therefore, I would think:
>
>{
>  ‘type’: ‘foo’,
>  ‘id’: ‘1’,
>  ‘lang’: ‘us’,
>  ‘title’: ‘Hello’
>}
>
>{
>  ‘type’: ‘foo’,
>  ‘id’: ‘1’,
>  ‘lang’: ’sp’,
>  ‘title’: ‘Hola'
>}
>
>Is appropriate. Same as:
>
><foo id=“1” lang=“us">
>   <title>Hello</title>
></foo>
>
>They are all just different representations of the same thing.
>
>Thank you.
>-Mark
>
>From: "Jordan, Bret" <bret.jordan@bluecoat.com>
>Date: Friday, April 22, 2016 at 11:01 AM
>To: Mark Davidson <mdavidson@soltra.com>
>Cc: "Wunder, John A." <jwunder@mitre.org>, "Masuoka, Ryusuke" <masuoka.ryusuke@jp.fujitsu.com>, "Mates, Jeffrey CIV DC3/DCCI" <Jeffrey.Mates@dc3.mil>, "cti@lists.oasis-open.org" <cti@lists.oasis-open.org>
>Subject: Re: [cti] i18n (RE: MVP Discussion) - An Updated Proposal
>
>
>So STIX is supposed to be about how to transmit the data in a structured form.  So if you had in your database the original Indicator and a bunch of translations, and you got a request for the Indicator in say en-us, then you would have two options (based on your legal contracts and terms of use agreements).
>
>1) Issue a new indicator under your identity space, and just include the en-us text.  As the example below
>
>2) Republish the original ja version along with the en-us translation.  You may or may not decide to include the de translation.  
>
>Thoughts????
> 
>
>
>
>
> “indicators": [
> {
>   "type": “indicator",
>   "id": "indicator--a1201df6-c352-4a81-9c7c-5a6f896a4eAA",
>
>   "revision": 1,
>   "created_at": "2015-12-03T13:13Z",
>   "created_by_ref": "identity--69a17e1b-bb45-4657-9a9d-96db3faccdDD",
>   "lang”:"en-us",
>   "title": "Dridex something or other 121",
>   “description": "some sort of description"
> },
>
>
>Thanks,
>
>Bret
>
>
>
>Bret Jordan CISSP
>Director of Security Architecture and Standards | Office of the CTO Blue Coat Systems PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050 "Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg." 
>
>
>	On Apr 22, 2016, at 08:50, Mark Davidson <mdavidson@soltra.com> wrote:
>
>	 “indicators": [
>	 {
>	   "type": “indicator",
>	   "id": "indicator--a1201df6-c352-4a81-9c7c-5a6f896a4e31",
>	
>	   "revision": 1,
>	   "created_at": "2015-12-03T13:13Z",
>	   "created_by_ref": "identity--69a17e1b-bb45-4657-9a9d-96db3faccdde",
>	   "lang”:"ja",
>	   "title": "Dridex キャンペーン - ボットネット 121",
>	   “description": "「これは偽のメッセージであるが、それは怖いかもしれません」"
>	 },
>
>