Re: [cti] STIX RC3 Review & Implementation Feedback

[John-Mark Gurney <jmg@newcontext.com>]

Wunder, John A. wrote this message on Fri, Nov 18, 2016 at 20:47 +0000:
> We’ve also had some broader feedback from Allan that’s based on him passing STIX 2.0 to his implementation team to get their opinions on things. His team had some thoughts/comments on these topics:
> 
> -          Versioning (version attribute vs. modified timestamp)
> -          Timestamp format (RFC3339 vs. unix epoch)
> -          Timestamp precision (is it necessary?)

Has his team bothered to read the emails relating to these topics?  If
they have not, then IMO, it's a waste of everyone's time to rehash these
issues YET AGAIN.  If they have, then I'm willing to discuss these.

> -          Bundle (single list vs. multiple buckets)

I am a proponent of a single list vs multiple buckets.  There is limited
benefit to having multiple buckets and it just increases the work needed
on an implementation.  I do not have strong opinion on either way though.

> Please don’t take this as a bad thing or as going backwards. This kind of implementation feedback is exactly what we wanted to get prior to finalizing 2.0. Even if we end up not changing anything because of these conversations they’re still worth having so that we go in knowing what we’re getting. Along those lines, if you can please do your own implementation evaluations so we can make sure that STIX 2.0 is solid and usable.

W/o substantive comments, it's hard not to see the first three issues
as going backwards...

-- 
John-Mark