Re: [cti] STIX 2.1 CSD01

On Thu, 12 Jul 2018 at 22:28, Kirillov, Ivan A. <ikirillov@mitre.org> wrote:

I second this motion.

Â

Regards,

Ivan

Â

From: <cti@lists.oasis-open.org> on behalf of John Wunder <jwunder@mitre.org>
Date: Thursday, July 12, 2018 at 2:17 PM
To: "cti@lists.oasis-open.org" <cti@lists.oasis-open.org>
Subject: [cti] STIX 2.1 CSD01

Â

>>>Email originates from a non-MITRE system. Use caution.<<<

Hi everyone,

Â

As you probably know, one thing we as a TC are working as fast as we can towards is the release of our first CSD (Committee Specification Draft) of STIX 2.1.ÂAs you may recall, we plan on issuing a series of CSDs until such point we are ready to release a CS (Committee Specification). AÂCSD is basically the first step towards the TC formalizing normative text for the things included in a release of STIX, and is also the start of our recently-balloted TC process that includes sponsorship, implementation, and interoperability text.

Â

At the same time, as we discuss the malware object, itâs becoming clear that we still have some work to do on it. We want to make sure we get it right, and in particular to consider how it relates to the Infrastructure object and other new SDOsÂplanned for CSD02 and beyond.

Â

This would do two things:

It would remove pressure on us to rush to solution on Malware and give us enough time to build more implementations, try out other approaches, and get it right.
It allows us to move forward on all of the other objects and features already in the CSD: Internationalization, Confidence, Location, Opinion, Note, support for mixed version content, and numerous other bug fixes and enhancements.

Â

If this sounds good, we would immediately begin work to finalize the drafts to get us to a CSD01 ballot:

First, clean up any lingering issues in the current 2.1 text (including reverting Malware to what it was in 2.0)
Next, release STIX 2.1 WD01 (the first STIX 2.1 working draft) for a 2 week TC review period
Address comments, and rinse and repeat releasing working drafts for review until we have one that has no substantive changes.
Open a ballot to approve CSD01.

Â

Based on maybe 2 iterations of the working drafts, that would mean opening a CSD ballot in the August timeframe. Once that happens and the CSD is approved we can continue our work to get sponsors, validate implementations, and write interoperability text.

Â

In order to do this, I move that the TC approve by unanimous consent deferring MalwareÂto aÂsubsequentÂSTIX 2.1 CSD and continuing with our CSD01 release process.

Â

Thanks all,

John

cti message