cti message
[Date Prev]
| [Thread Prev]
| [Thread Next]
| [Date Next]
--
[Date Index]
| [Thread Index]
| [List Home]
Subject: Re: [cti] Internationalization: lang field required or optional?
- From: "Jason Keirstead" <Jason.Keirstead@ca.ibm.com>
- To: Allan Thomson <athomson@lookingglasscyber.com>
- Date: Fri, 24 Feb 2017 09:15:02 -0400
I also agree with Alan and John in the
preference to make this optional.
In general I do not like sending bytes
when bytes are not required in a data interchange format, especially when
considering the scale of data we will be dealing with in STIX/TAXII. We
should be looking for opportunities to keep the data format trim. Truthfully,
the vast majority of data in an ecosystem will all be the same language,
and thus having to transmit a language tag for every single object in a
package is redundant information.
There is also another issue with making
it "required", and that is that we would then have to support
"unknown" or "undefined" - which many products would
have to mark content as since they may not know the producer of the content's
native language. There is an ISO 639 language tag for "undefined",
but there is no IETF tag for "undefined" in the IANA registry,
they never adopted the ISO entry. So making this mandatory may force a
revisit of the RFC5646decision.
-
Jason Keirstead
STSM, Product Architect, Security Intelligence, IBM Security Systems
www.ibm.com/security| www.securityintelligence.com
Without data, all you are is just another person with an opinion - Unknown
From:
Allan Thomson <athomson@lookingglasscyber.com>
To:
Bret Jordan <Bret_Jordan@symantec.com>,
"Wunder, John A." <jwunder@mitre.org>, "cti@lists.oasis-open.org"
<cti@lists.oasis-open.org>
Date:
02/23/2017 07:01 PM
Subject:
Re: [cti] Internationalization:
lang field required or optional?
Sent by:
<cti@lists.oasis-open.org>
If you are expecting to use different language
content then its required for interoperability reasons.
But by marking it required in the spec
means that all content must have it even when most content is not multi-language.
I generally would prefer more tolerance
in the spec level and let the products/market use good behavior to drive
what fields are included or not.
If people care about language and multi-language
support then they will use it. If they don’t then they wont be interoperable
as that will be part of the test in the interop spec.
allan
From: Bret Jordan <Bret_Jordan@symantec.com>
Date: Thursday, February 23, 2017 at 2:04 PM
To: Allan Thomson <athomson@lookingglasscyber.com>, "Wunder,
John" <jwunder@mitre.org>, "cti@lists.oasis-open.org"
<cti@lists.oasis-open.org>
Subject: Re: [cti] Internationalization: lang field required or optional?
My thoughts....
1) In reality we are talking about a feature
not a property.
2) If it is property of this feature is
optional, then the only products that will implement this feature, are
those that care about internationalization.
3) If it is required, then everyone will
be forced to implement it.
Personally I see this as a data quality
issue, not a STIX issue. And I think both sides can suffer from it.
Problems with Required:
a) product or tool does not care, does
not provide a UX for it, and just hard codes it to something, say "en"
b) product or tool does provide a UX for
it, but analyst does not care and it just remains what ever the default
is.
Problems with Optional:
a) product or tool does not care, does
not provide a UX for it, and just leaves it out of the data. So it
is undef.
b) product or tool does care and provides
a UX for it and the analyst does not care and leaves it blank.
c) Broker product or tool takes in data
that has a lang tag, but they do not support that feature so they never
implemented it. So when the data goes back out the other side, the
language tag is now missing.
I personally do not see the harm in requiring
tools to support and populate the Lang tag. In the spec we can define
an "unknown" value, so if you are doing bulk loading of data
and you honestly do not know the language, you could just flag it as "unknown".
Then at least as the consumer you would know that the producer did
not know the language. Versus getting an object where the language
tag is omitted and you do not know if:
i) they did not know the language
ii) there tool did not support it
iii) they were just lazy and did not add
it.
Once again, this is a data quality problem
and if we make the lang field required, then it is a SUPER EASY interop
test to see if they do it right. If it is optional, then you are
just at a guess all the time.
Bret
From: cti@lists.oasis-open.org <cti@lists.oasis-open.org>
on behalf of Allan Thomson <athomson@lookingglasscyber.com>
Sent: Thursday, February 23, 2017 2:29:59 PM
To: Wunder, John A.; cti@lists.oasis-open.org
Subject: Re: [cti] Internationalization: lang field required or optional?
Prefer optional.
From: "cti@lists.oasis-open.org"
<cti@lists.oasis-open.org> on behalf of "Wunder, John"
<jwunder@mitre.org>
Date: Thursday, February 23, 2017 at 12:59 PM
To: "cti@lists.oasis-open.org" <cti@lists.oasis-open.org>
Subject: [cti] Internationalization: lang field required or optional?
Hey everyone,
We’re getting very close to having a completed
approach for internationalization, you can see the full writeup here: https://docs.google.com/document/d/15qD9KBQcVcY4FlG9n_VGhqacaeiLlNcQ7zVEjc8I3b4/edit#heading=h.61fy0hlsdirz
We do have one remaining question before
we can move forward though. As part of the proposal, every single top-level
object has a “lang” field, that identifies the language of the text content
in that object. What we need to decide is whether we make that field required
or optional.
If we make the field required, every top-level
object in STIX (SDOs and SROs) would have to have a “lang” field in it
or it would be invalid STIX. If we make it optional, producers could either
include the field or not.
Here are some thoughts:
Making it required:
- All
SDOs and SROs would have a language tag, so consumers could depend on it
being there
- It
would encourage producers to actually fill it out, because they wouldn’t
be creating valid STIX otherwise
- It
shows we have a commitment to internationalization
Making it optional:
- Any
SRO or SDO could have a language tag, so consumers could not depend on
it
- Producers
would not have to create it
- We
do have a SHOULD requirement saying that it should be included
My opinion is that we should make it optional.
If it’s required, I think people who don’t want to do internationalization
(especially those creating one-off scripts or open source tools) will hardcode
it to English and things will be mislabeled. If it’s optional, I think
those who need/want to support internationalization and would do it right
(most/all vendors, major open source projects) will populate it correctly
regardless…because they need it…while those who couldn’t be bothered
will be able to leave it off and we won’t have mis-labeled data. Also
it’s almost not worth saying, but we already have a bunch of required
fields on every SDO/SRO and I’ve already had one conversation with someone
who said there’s a lot of bloat…would like to avoid adding to that.
Anyway, what does everyone think…required
or optional?
John
[Date Prev]
| [Thread Prev]
| [Thread Next]
| [Date Next]
--
[Date Index]
| [Thread Index]
| [List Home]