Re: [cti] STIX RC3 - issues.

[Trey Darley <trey@kingfisherops.com>]

On 11.11.2016 14:58:55, Allan Thomson wrote:
> Suggest that Cyber Observables just use the same mechanism defined
> for STIX custom properties and remove the way CybOx did it.
> 

The entire Cyber Observables (formerly CybOX) data model was built
around the concept of base objects with extensions. CybOX
customization was built around the concept of custom object extensions
from the very beginning.

In the course of the editorial calls on the document merge, several
STIX editors argued for *also* allowing custom object properties in
CybOX, since they were defined in STIX. Ivan and I agreed under
protest, in the spirit of choosing one's battles.

Ripping out custom extensions from the Observable data model would
mean a major trip back to the drawing board. If anything, we should
remove custom object properties from the Observable data model. Or
content ourselves with their being two ways of customizing things.
Ivan and I *explicitly* pointed this out when as a downside of adding
custom object properties during the document merger.

-- 
Cheers,
Trey
++--------------------------------------------------------------------------++
Kingfisher Operations, sprl
gpg fingerprint: 85F3 5F54 4A2A B4CD 33C4  5B9B B30D DD6E 62C8 6C1D
++--------------------------------------------------------------------------++
--
"With sufficient thrust, pigs fly just fine. However, this is not
necessarily a good idea. It is hard to be sure where they are going to
land, and it could be dangerous sitting under them as they fly
overhead." --RFC 1925

Attachment: signature.asc
Description: Digital signature