OASIS Mailing List ArchivesView the OASIS mailing list archive below
or browse/search using MarkMail.

 


Help: OASIS Mailing Lists Help | MarkMail Help

cti message

[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]


Subject: Re: [cti] i18n (RE: MVP Discussion) - An Updated Proposal


Agreed. Plus, translations are never perfect, just ask JFK. So even if the same organization produces content in two languages it seems important to me to track them separately. For example, if your translator is having a bad day you may need to update only one translation.

John

From: "Jordan, Bret" <bret.jordan@bluecoat.com>
Date: Friday, April 22, 2016 at 1:04 PM
To: Mark Davidson <mdavidson@soltra.com>
Cc: "Mates, Jeffrey CIV DC3/DCCI" <Jeffrey.Mates@dc3.mil>, "Wunder, John A." <jwunder@mitre.org>, "Masuoka, Ryusuke" <masuoka.ryusuke@jp.fujitsu.com>, "cti@lists.oasis-open.org" <cti@lists.oasis-open.org>
Subject: Re: [cti] i18n (RE: MVP Discussion) - An Updated Proposal

They are different...  The en-us and fr may have been produced by different people.  And as such, can not be merged together.  


Thanks,

Bret



Bret Jordan CISSP
Director of Security Architecture and Standards | Office of the CTO
Blue Coat Systems
PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050
"Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg." 

On Apr 22, 2016, at 09:32, Mark Davidson <mdavidson@soltra.com> wrote:

This is ultimately the question I think we need to ask: Are these two the same thing, or not? (pattern layer abstracted for example purposes):

Ex 1 -
{‘type’: ‘indicator’,
‘id’: ‘TBD’,
‘lang’: ‘us’,
‘title’: ‘some bad things to look for’,
‘ip-list’: [‘1.1.1.1’, ‘2.2.2.2’],
}


Ex 2 -
{‘type’: ‘indicator’,
‘id’: ‘TBD’,
‘lang’: ‘french’,
‘title’: ‘quelques mauvaises choses a rechercher’,  // translation provided by google
‘ip-list’: [‘1.1.1.1’, ‘2.2.2.2’],
}


Clearly not every field is the same (they differ in lang and title). However, I’d argue that the english version is 100% equal to:

<indicator id=“TBD” lang=“us”>
<title>some bad things to look for</title>
<ip>1.1.1.1</ip>
<ip>2.2.2.2</ip>
</indicator>

I think really what we are getting at is “what are the rules for two TLOs being the same ID and revision”? I think they are the same even if they differ in serialization format (XML vs JSON).

If the two JSON examples are different, then they must be different object series (it doesn’t make sense for them to be revisions in the same object series). Therefore, one single “thing” will have as many object series as it has translation languages. To me it seems that this is a case of having two representations for the same thing.



Thank you.
-Mark



On 4/22/16, 11:23 AM, "Mates, Jeffrey CIV DC3/DCCI" <Jeffrey.Mates@dc3.mil> wrote:

I'm not sure if I understand, are you proposing sending a second copy of the full object with the same ID and revision number with different content?

If so I am strongly against it as I the translation object gives us everything this does and more without risking breaking some major backend components of STIX.


Jeffrey Mates, Civ DC3/DCCI
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Computer Scientist
Defense Cyber Crime Institute
jeffrey.mates@dc3.mil
410-694-4335

-----Original Message-----
From: Mark Davidson [mailto:mdavidson@soltra.com]
Sent: Friday, April 22, 2016 11:12 AM
To: Jordan, Bret
Cc: Wunder, John A.; Masuoka, Ryusuke; Mates, Jeffrey CIV DC3/DCCI; cti@lists.oasis-open.org
Subject: [Non-DoD Source] Re: [cti] i18n (RE: MVP Discussion) - An Updated Proposal

I think different languages of the same indicator are not revisions of each other and are just different representations of the same resource.

Therefore, I would think:

{
‘type’: ‘foo’,
‘id’: ‘1’,
‘lang’: ‘us’,
‘title’: ‘Hello’
}

{
‘type’: ‘foo’,
‘id’: ‘1’,
‘lang’: ’sp’,
‘title’: ‘Hola'
}

Is appropriate. Same as:

<foo id=“1” lang=“us">
 <title>Hello</title>
</foo>

They are all just different representations of the same thing.

Thank you.
-Mark

From: "Jordan, Bret" <bret.jordan@bluecoat.com>
Date: Friday, April 22, 2016 at 11:01 AM
To: Mark Davidson <mdavidson@soltra.com>
Cc: "Wunder, John A." <jwunder@mitre.org>, "Masuoka, Ryusuke" <masuoka.ryusuke@jp.fujitsu.com>, "Mates, Jeffrey CIV DC3/DCCI" <Jeffrey.Mates@dc3.mil>, "cti@lists.oasis-open.org" <cti@lists.oasis-open.org>
Subject: Re: [cti] i18n (RE: MVP Discussion) - An Updated Proposal


So STIX is supposed to be about how to transmit the data in a structured form.  So if you had in your database the original Indicator and a bunch of translations, and you got a request for the Indicator in say en-us, then you would have two options (based on your legal contracts and terms of use agreements).

1) Issue a new indicator under your identity space, and just include the en-us text.  As the example below

2) Republish the original ja version along with the en-us translation.  You may or may not decide to include the de translation.  

Thoughts????





“indicators": [
{
 "type": “indicator",
 "id": "indicator--a1201df6-c352-4a81-9c7c-5a6f896a4eAA",

 "revision": 1,
 "created_at": "2015-12-03T13:13Z",
 "created_by_ref": "identity--69a17e1b-bb45-4657-9a9d-96db3faccdDD",
 "lang”:"en-us",
 "title": "Dridex something or other 121",
 “description": "some sort of description"
},


Thanks,

Bret



Bret Jordan CISSP
Director of Security Architecture and Standards | Office of the CTO Blue Coat Systems PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050 "Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg."


On Apr 22, 2016, at 08:50, Mark Davidson <mdavidson@soltra.com> wrote:

“indicators": [
{
  "type": “indicator",
  "id": "indicator--a1201df6-c352-4a81-9c7c-5a6f896a4e31",

  "revision": 1,
  "created_at": "2015-12-03T13:13Z",
  "created_by_ref": "identity--69a17e1b-bb45-4657-9a9d-96db3faccdde",
  "lang”:"ja",
  "title": "Dridex キャンペーン - ボットネット 121",
  “description": "「これは偽のメッセージであるが、それは怖いかもしれません」"
},





[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]