Re: [cti] Re: [EXT] [cti] STIX 2.1 Schedule

I would prefer to delay. We sped through releasing STIX 2.0, releasing it without some important features. STIX 2.1 should be about getting enough features into STIX that it is attractive enough to entice vendors who want to use it in actual products. And for that I'm happy to wait.

I personally thought the original cadence we were targeting was fairly unrealistic, and likely to be extended. Maybe after the release of STIX 2.1 we should revisit the timeline to realign it based on past experience?

Cheers

Terry MacDonald

Cosive

On 29/04/2017 00:59, "Paul Patrick" <Paul.Patrick@fireeye.com> wrote:

I’m in general agreement with Bret that there are too many missing pieces to enable broad adoption, so we should get a good number of them filled rather than rush out something.

Paul

From: <cti@lists.oasis-open.org> on behalf of Bret Jordan <Bret_Jordan@symantec.com>
Date: Thursday, April 27, 2017 at 4:03 PM
To: "Wunder, John A." <jwunder@mitre.org>, "cti@lists.oasis-open.org" <cti@lists.oasis-open.org>
Subject: [cti] Re: [EXT] [cti] STIX 2.1 Schedule

Personally, I feel like we need to get some of these features out the door before we can get broad adoption. While I am okay with pushing the date back a bit, I worry that it will slip even further. I would really like to see us pick a solid date and then prioritize the list of things that we need to finish. Then build a burn down chart for those features so we know if we are going to meet our date.

I also feel like it would be good to speed up on a few key areas.

Bret

From: cti@lists.oasis-open.org <cti@lists.oasis-open.org> on behalf of Wunder, John A. <jwunder@mitre.org>
Sent: Thursday, April 27, 2017 11:51:45 AM
To: cti@lists.oasis-open.org
Subject: [EXT] [cti] STIX 2.1 Schedule

All,

As discussed on the last TC call, one item the TC needs to figure out is whether we want to stick to our original July CSD timeframe for STIX 2.1. We’ve tried to focus ourselves more tightly on just a few issues at a time, but obviously that will have impacts on our schedule. It would either mean we keep the same schedule and have smaller releases, or that we have the same sized releases but a longer schedule.

To outline the options:

1. Keeping our current pace, aim for a July CSD. To give us time for final decision making and editorial work, that would mean major features would need to be done by June at the latest (and ideally earlier). That would give us, at most, about 2 months worth of active development. Looking at the items on our roadmap (https://docs.google.com/document/d/1yvqWaPPnPW-2NiVCLqzRszcx91ffMowfT5MmE9Nsy_w/edit#heading=h.rnemfnrew1l4)that probably means things would get cut.

2. Keeping our current pace, aim for an October CSD. That gives us an additional 3 months of active development and a lot more breathing room to spend time on getting things like actions, event/incident, and digital signatures right. It also puts a bit more breathing room between the STIX 2.0 CS and the STIX 2.1 CSD. But…it is longer.

Which do you prefer? Myself and the other STIX co-chairs (Sarah, Trey, and Ivan) were talking about it and we prefer option 2…but this is your decision, not ours.

Speeding up the pace to try to fit in everything before July is probably not realistic unless we can get significantly increased participation from members of the TC who are not already active…plus, those that are active would need to be comfortable with not being able to participate in every conversation (and I know we all care about lots of aspects of STIX).

John

This email and any attachments thereto may contain private, confidential, and/or privileged material for the sole use of the intended recipient. Any review, copying, or distribution of this email (or any attachments thereto) by others is strictly prohibited. If you are not the intended recipient, please contact the sender immediately and permanently delete the original and any copies of this email and any attachments thereto.

cti message