[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]
Subject: Re: [cti] Re: [EXT] Re: [cti] Language Content
|
I agree with Rich on this. Like I said recently I do think we need to do a better job categorizing and describing objects so that itâs easier to understand how you can use them. But that doesnât mean erasing the distinctions between them â especially in the case
of language content, data markings, etc. which have some pretty specific processing rules, conformance statements, and interop text around them that the objects donât have. Mixing that in with the other SDOs leads you to being able to do things with them that
can interfere with those processing rules and so IMO itâs better to keep them separate. John From: <cti@lists.oasis-open.org> on behalf of "Bret Jordan (CS)" <Bret_Jordan@symantec.com> I would argue that they are STIX Objects that can be shared just like a Note or an Opinion. Under your definition, then a Note or an Opinion should be meta data as well and moved out of Part 2. Bret From: Piazza, Rich <rpiazza@mitre.org> Bret, I see where you are going â you see duplicate text, and you want to clean it up.
However, I still resist putting âeverythingâ in Part 2. I see part 2 as describing the CTI data that STIX can share. Things like language content, markings are NOT CTI data, but metadata, and I think leaving them in Part 1 is useful
separation. Rich P. From:
<cti@lists.oasis-open.org> on behalf of Bret Jordan <Bret_Jordan@symantec.com> I will put together a full copy of what this would look like. But keep in mind, we redefine common properties in other objects, so this is not new. The reason I am doing this now, is this is
part of making the editorial changes for the Cyber Observable changes. I am trying to find all of the problems with the use of STIX Objects and STIX objects and other terms we have for the. So this is all part of the same problem I am trying to fix. And
thanks goes to John-Mark for pointing out the consistency problems. Bret From: Allan Thomson <athomson@lookingglasscyber.com> Bret â I appreciate the goal of making things to easier read but without seeing a concrete proposal and set of changes then it is hard to respond to the âany objectionsâ statement. You suggest that this is a very simple change but it sounds from reading your description of the change that you are changing the structure and behavior of using the lang property. So that seems more than just a simple change. In general if we are making changes to the structure of objects then it would be appropriate that we can see the change before saying âwe agreeâ. I would also say that we have yet to see a merged set of changes from the SCO work that *has* been agreed to by the TC and further changes to other unrelated aspects of the spec should be appropriately prioritized behind that other
work. Allan From:
"cti@lists.oasis-open.org" <cti@lists.oasis-open.org> on behalf of Bret Jordan <Bret_Jordan@symantec.com> All, In STIX 2.1 we added an object called Language Content to the specification, to allow for internationalization. This is a good thing, and I think will address many use cases. My concern is
not that we added it, but rather, where we the editors added it. It was decided that it did not make sense for the Language Content object to have the "lang" property. As such, the editors decided that we should put the object in Part 1 and treat it as a
STIX Object but not really a STIX Object more of a STIX object (little o) because it would not inherit all of the common properties. After many months of thought and reading of the specification, and hearing people's comments when they read our specification, I think what we did is in error. We should have just added this
to Part 2, said that it inherited all of the common properties, and that the "lang" property should or must not be used. Or if it is used, it must be ignored. We have precedent for doing this. In fact, this is HOW we as a TC decided to address this. You can see an example of this in the Attack Pattern object where we "redefined" the external references
common property. Stylistically, what we do is we set the background color to be grey for that property. The "type" property is also another property that we redefine on every object. So I am wondering if anyone would have an objection to making this very very simple change in the documents. This is being driven by a consistency problem that we have in the documents, that is being exacerbated by the changes to observed data. So I am trying to simplify the documents and their structure
to make fixing the consistency problem easier and make it more intuitive for people consuming our specification. Bret |
[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]