Re: [cti] Working Call Notes

Bret – thanks for the notes.

I continue to disagree on item 5) being necessary and have filled my feedback in github. My feedback suggests a compromise that might be acceptable.

Other issues that require written text to review, i.e. 1; 2; 6 -> I agree with direction but will reserve agreement until text is shown.

Allan

From: "cti@lists.oasis-open.org" <cti@lists.oasis-open.org> on behalf of Bret Jordan <Bret_Jordan@symantec.com>
Date: Tuesday, January 23, 2018 at 1:11 PM
To: "cti@lists.oasis-open.org" <cti@lists.oasis-open.org>
Subject: [cti] Working Call Notes

On the working call the following issues were discussed, here is the consensus from the call. If you disagree with any of these, please reply to the list and record that in the github issue tracker. If there is no objections by Friday Feb 2nd, the editors will begin work on fixing these in the documents.

1) Change external references to use a single string for hashes #36

https://github.com/oasis-tcs/cti-stix2/issues/36

Resolution:

We discussed this on the working call on 2018-01-23 and the consensus on the call was that we need to address/fix this for 2.1, however, we did not come to an agreement on how to fix it. We identified 2-3 ways that this could be fixed (and there may be more). 1) change to just a string, 2) make individual properties for the hash that is used in the specific version, 3) add normative text that calls out the hash that MUST be used, if one is used. Basically keep the dictionary but define a single entry that is used in this context. Jason also brought up that we need to fix this for the artifact object as well.

2) Change labels to be just user defined tags #37

https://github.com/oasis-tcs/cti-stix2/issues/37

Resolution:

We discussed this on the working call on 2018-01-23 and while Rich S is unsure about it, no one objected to fixing this in STIX 2.1. JMG was originally unsure, but then after hearing everyone's feedback, he also agreed with Sarah and Jason that this needs to be fixed / changed.

3) Add clarifying text about using version filter #25

https://github.com/oasis-tcs/cti-taxii2/issues/25

Resolution:

We talked about this on the working call on 2018-01-23 and the consensus on that call was to change the text to say "MUST ONLY return the latest version". No one on the call objected to making this change.

4) Version key word 'all' should not be allowed when using multiple version parameters #26

https://github.com/oasis-tcs/cti-taxii2/issues/26

Resolution:

This was discussed on the working call on 2018-01-23 and no one objected to make this normative text change. The proposed text was "the all key word MUST NOT be used with any other version key word or version parameter".

5) Add a filter of added_before #27

https://github.com/oasis-tcs/cti-taxii2/issues/27

Resolution:

This was discussed on the working call on 2018-01-23 and everyone supported adding this. No one objected to this.

6) Need clarity on if api_roots allows relative URLs #28

https://github.com/oasis-tcs/cti-taxii2/issues/28

Resolution:

This was discussed on the working call on 2018-01-23 and the consensus was that this needs to be fixed / addressed, however, there is not yet a solid proposal for text on how to fix it, just that it needs to be fixed.

Bret

cti message