Thanks for the reply. I just mostly wanted to confirm that I understood both use cases.
I did assume that your rationale for combinatorial extensions was so you could âbundleâ related extensions.
I was concerned with re-use of the extension definition by others. I was thinking it would be âcleanerâ to just have one extension defined.
However, I see that you might want to introduce a whole new domain with lots of new SDOs, SCOs, and additional properties on existing objects, so it makes sense that you would want to put them all in one schema/extension.
I was also thinking that when one is using a combinatorial extension that they need to use all of the parts. But there is nothing in the new spec language that implies that.
So, I have changed my mind â I now am in favor of combinatorial extensions!
Rich
From: <cti@lists.oasis-open.org> on behalf of aa tt <atcyber1000@gmail.com>
Date: Wednesday, October 7, 2020 at 5:54 PM
To: Rich Piazza <rpiazza@mitre.org>
Cc: "cti@lists.oasis-open.org" <cti@lists.oasis-open.org>
Subject: [EXT] [cti] Re: Question about combinatorial extension
Rich - the simplest analogy I can think of, is this.
I can write 1 word document with 2 paragraphs. Where the document describes a concept with two related aspects described in the document.
I can write 2 word documents, with 1 paragraph each. Where each document describes a separate concept entirely.
Your example below suggests the 2 extensions are completely unrelated to each other. In that case, it would make sense to write 2 separate documents (1 for each extension).
For examples, where authors want to publish related content as a single extension -> I propose that STIX extension should give authors the *option* to write the 1 document with 2 paragraphs *if* they want to.
And we should not force them to write 2 separate documents.
I didnât want to belabor the point on the call yesterday, but I wanted to check my understanding of the combinatorial extension.
Letâs assume that we have two extensions defined (similar to the spec examples):
I introduced new ids, so as not to confuse it with other extension examples.
âidâ: âstix-extension--9994a318-2a81-4b04-a79a-7c515cfae643â,
"type": "stix-extension",
"name": "Extension My Favorite SDO",
"description": "This schema adds a new object my-favorite-sdo",
"created_by": "identity--uuid1",
âextension_typesâ: [ ânew_sdoâ ]
âidâ: âstix-extension--29c8ae7a-6779-40dd-92e5-0806cb61a6faâ,
"type": "stix-extension",
"description": "This schema adds rank and toxicityâ
"created_by": "identity--uuid1",
âextension_typesâ: [ âextends_subcompâ ]
Using these extensions, Iâm not sure what would change in your instance on page 221, except the indicator would be using the extension stix-extension--29c8ae7a-6779-40dd-92e5-0806cb61a6fa instead
of the combinatorial extension that included both extension types (stix-extension--a932fcc6-e032-176c-126f-cb970a5a1fff).
So what is the advantage of the combinatorial extension? What am I missing?