[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]
Subject: Re: [cti] i18n (RE: MVP Discussion) - An Updated Proposal
I’d like to see the current state summarized on the call on Tuesday, if somebody is available to do that.
I feel like there is probably a simpler method for achieving the same goals, but I’ll need to understand what the current state is before I can (or can’t) say that concretely. Personally, it seems like the proposal enables sending a bunch of data objects to the recipient and asking the recipient to calculate their desired representation instead of sending the desired representation in the first place.
Thank you.
-Mark
On 4/22/16, 1:16 PM, "Mates, Jeffrey CIV DC3/DCCI" <cti@lists.oasis-open.org on behalf of Jeffrey.Mates@dc3.mil> wrote:
>I think the fact that they can't be merged is why we need the translation object Ryu proposed. That way if organization A publishes an indicator in English and organization B has someone who translates the description of the indicator into Japanese and then runs it against historic data.
>
>They then note this indicator can be tied to a Threat Actor and publish this out in a STIX document. If they created a new object organization A would be SOL as they didn't have any translators on site, but if this all used the original Indicator as Ryu's model proposed then everyone wins.
>
>Plus translations of individual text fields can be updated separately ensuring that even if a translator had a bad day that this wouldn't break down your attribution graphs.
>
>Jeffrey Mates, Civ DC3/DCCI
>~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>Computer Scientist
>Defense Cyber Crime Institute
>jeffrey.mates@dc3.mil
>410-694-4335
>
>
>-----Original Message-----
>From: Wunder, John A. [mailto:jwunder@mitre.org]
>Sent: Friday, April 22, 2016 1:14 PM
>To: Jordan, Bret; Mark Davidson
>Cc: Mates, Jeffrey CIV DC3/DCCI; Masuoka, Ryusuke; cti@lists.oasis-open.org
>Subject: [Non-DoD Source] Re: [cti] i18n (RE: MVP Discussion) - An Updated Proposal
>
>Agreed. Plus, translations are never perfect, just ask JFK. So even if the same organization produces content in two languages it seems important to me to track them separately. For example, if your translator is having a bad day you may need to update only one translation.
>
>John
>
>From: "Jordan, Bret" <bret.jordan@bluecoat.com>
>Date: Friday, April 22, 2016 at 1:04 PM
>To: Mark Davidson <mdavidson@soltra.com>
>Cc: "Mates, Jeffrey CIV DC3/DCCI" <Jeffrey.Mates@dc3.mil>, "Wunder, John A." <jwunder@mitre.org>, "Masuoka, Ryusuke" <masuoka.ryusuke@jp.fujitsu.com>, "cti@lists.oasis-open.org" <cti@lists.oasis-open.org>
>Subject: Re: [cti] i18n (RE: MVP Discussion) - An Updated Proposal
>
>
>They are different... The en-us and fr may have been produced by different people. And as such, can not be merged together.
>
>
>
>Thanks,
>
>Bret
>
>
>
>Bret Jordan CISSP
>Director of Security Architecture and Standards | Office of the CTO Blue Coat Systems PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 "Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg."
>
>
> On Apr 22, 2016, at 09:32, Mark Davidson <mdavidson@soltra.com> wrote:
>
> This is ultimately the question I think we need to ask: Are these two the same thing, or not? (pattern layer abstracted for example purposes):
>
> Ex 1 -
> {‘type’: ‘indicator’,
> ‘id’: ‘TBD’,
> ‘lang’: ‘us’,
> ‘title’: ‘some bad things to look for’,
> ‘ip-list’: [‘1.1.1.1’, ‘2.2.2.2’],
> }
>
>
> Ex 2 -
> {‘type’: ‘indicator’,
> ‘id’: ‘TBD’,
> ‘lang’: ‘french’,
> ‘title’: ‘quelques mauvaises choses a rechercher’, // translation provided by google
> ‘ip-list’: [‘1.1.1.1’, ‘2.2.2.2’],
> }
>
>
> Clearly not every field is the same (they differ in lang and title). However, I’d argue that the english version is 100% equal to:
>
> <indicator id=“TBD” lang=“us”>
> <title>some bad things to look for</title>
> <ip>1.1.1.1</ip>
> <ip>2.2.2.2</ip>
> </indicator>
>
> I think really what we are getting at is “what are the rules for two TLOs being the same ID and revision”? I think they are the same even if they differ in serialization format (XML vs JSON).
>
> If the two JSON examples are different, then they must be different object series (it doesn’t make sense for them to be revisions in the same object series). Therefore, one single “thing” will have as many object series as it has translation languages. To me it seems that this is a case of having two representations for the same thing.
>
>
>
> Thank you.
> -Mark
>
>
>
> On 4/22/16, 11:23 AM, "Mates, Jeffrey CIV DC3/DCCI" <Jeffrey.Mates@dc3.mil> wrote:
>
>
>
> I'm not sure if I understand, are you proposing sending a second copy of the full object with the same ID and revision number with different content?
>
> If so I am strongly against it as I the translation object gives us everything this does and more without risking breaking some major backend components of STIX.
>
>
> Jeffrey Mates, Civ DC3/DCCI
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> Computer Scientist
> Defense Cyber Crime Institute
> jeffrey.mates@dc3.mil
> 410-694-4335
>
> -----Original Message-----
> From: Mark Davidson [mailto:mdavidson@soltra.com]
> Sent: Friday, April 22, 2016 11:12 AM
> To: Jordan, Bret
> Cc: Wunder, John A.; Masuoka, Ryusuke; Mates, Jeffrey CIV DC3/DCCI; cti@lists.oasis-open.org <mailto:cti@lists.oasis-open.org>
> Subject: [Non-DoD Source] Re: [cti] i18n (RE: MVP Discussion) - An Updated Proposal
>
> I think different languages of the same indicator are not revisions of each other and are just different representations of the same resource.
>
> Therefore, I would think:
>
> {
> ‘type’: ‘foo’,
> ‘id’: ‘1’,
> ‘lang’: ‘us’,
> ‘title’: ‘Hello’
> }
>
> {
> ‘type’: ‘foo’,
> ‘id’: ‘1’,
> ‘lang’: ’sp’,
> ‘title’: ‘Hola'
> }
>
> Is appropriate. Same as:
>
> <foo id=“1” lang=“us">
> <title>Hello</title>
> </foo>
>
> They are all just different representations of the same thing.
>
> Thank you.
> -Mark
>
> From: "Jordan, Bret" <bret.jordan@bluecoat.com>
> Date: Friday, April 22, 2016 at 11:01 AM
> To: Mark Davidson <mdavidson@soltra.com>
> Cc: "Wunder, John A." <jwunder@mitre.org>, "Masuoka, Ryusuke" <masuoka.ryusuke@jp.fujitsu.com>, "Mates, Jeffrey CIV DC3/DCCI" <Jeffrey.Mates@dc3.mil>, "cti@lists.oasis-open.org" <cti@lists.oasis-open.org>
> Subject: Re: [cti] i18n (RE: MVP Discussion) - An Updated Proposal
>
>
> So STIX is supposed to be about how to transmit the data in a structured form. So if you had in your database the original Indicator and a bunch of translations, and you got a request for the Indicator in say en-us, then you would have two options (based on your legal contracts and terms of use agreements).
>
> 1) Issue a new indicator under your identity space, and just include the en-us text. As the example below
>
> 2) Republish the original ja version along with the en-us translation. You may or may not decide to include the de translation.
>
> Thoughts????
>
>
>
>
>
> “indicators": [
> {
> "type": “indicator",
> "id": "indicator--a1201df6-c352-4a81-9c7c-5a6f896a4eAA",
>
> "revision": 1,
> "created_at": "2015-12-03T13:13Z",
> "created_by_ref": "identity--69a17e1b-bb45-4657-9a9d-96db3faccdDD",
> "lang”:"en-us",
> "title": "Dridex something or other 121",
> “description": "some sort of description"
> },
>
>
> Thanks,
>
> Bret
>
>
>
> Bret Jordan CISSP
> Director of Security Architecture and Standards | Office of the CTO Blue Coat Systems PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 "Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg."
>
>
> On Apr 22, 2016, at 08:50, Mark Davidson <mdavidson@soltra.com> wrote:
>
> “indicators": [
> {
> "type": “indicator",
> "id": "indicator--a1201df6-c352-4a81-9c7c-5a6f896a4e31",
>
> "revision": 1,
> "created_at": "2015-12-03T13:13Z",
> "created_by_ref": "identity--69a17e1b-bb45-4657-9a9d-96db3faccdde",
> "lang”:"ja",
> "title": "Dridex キャンペーン - ボットネット 121",
> “description": "「これは偽のメッセージであるが、それは怖いかもしれません」"
> },
>
>
>
>
>
[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]