Re: [members] Call for Comment: proposed Charter for Heimdall Data Format (HDF) TC

["Stefan Hagen" <stefan@hagen.link>]

Dear Chartering Crew,

On Fri, Dec 2, 2022, at 23:39, Chet Ensign wrote:

To OASIS Members:

A draft TC charter has been submitted to establish the Heimdall Data Format (HDF) TC. [...] the proposed charter is hereby submitted for comment. The comment period shall remain open until 23:59 GMT on 15 December 2023.

[...] Any OASIS member may post to this list by sending an email to: oasis-charter-discuss@lists.oasis-open.org. [...]

Comments received will be reviewed by the proposers and a log of the comments and their resolution will be posted to oasis-charter-discuss mailing list before the telephone call with the convener. [...]

We encourage member comment and ask that you note the name of the proposed TC (HDF) in the subject line of your email message. [...]

everyone knows that three letter acronyms are hard and that on a world-wide scale they are guaranteed to cause conflict-

But, in this case I propose avoidance by seeking a better acronym and name. Rationale:

1. Acronym of deliverable:

Since the 80s there is a data format (still alive and well) with that acronym - and it is also a data format:

HDF is the gorilla in the room - "Hierarchical Data Format (HDF) is a set of file formats (HDF4, HDF5) designed to store and organize large amounts of data. Originally developed at the U.S. National Center for Supercomputing Applications, it is supported by The HDF Group, a non-profit corporation whose mission is to ensure continued development of HDF5 technologies and the continued accessibility of data stored in HDF." from Wikipedia(EN) per https://en.wikipedia.org/wiki/Hierarchical_Data_Format

2. Risk of confusion:

 

Even spelled out the "Heimdall Data Format" is phonetically and letter-wise very close to Hierarchical Data Format

3. TC short code semantics associated:

From (1.) it follows, that the technical committee will for sure be associated by many with the Hierarchical Data Format.

Sometimes this may be wanted.

On the marketplace this can be legally challenged (in case there is an existing trade mark of some kind).

But, most importantly from my experience as editor of the OASIS DSS Standard as part of the OASIS DSS TC,

this is mostly annoying for both members and people contacting the TC when there is the confusion caused by

a TC and product Acronym "Digital Signature Services" DSS with the precedent "Payment Card Industry Data Security Standard" often abbreviated as PCI DSS or DSS.

This may also reduce market reach in case the TC members intend to "spread the word" ;-)

Thanks for considering.

PS:

This request for comments made me aware first time of the "Security Automation Framework CLI - 

The MITRE Security Automation Framework (SAF) Command Line Interface (CLI) brings together applications, techniques, libraries, and tools developed by MITRE and the security community to streamline security automation for systems and DevOps pipelines" cited per https://saf-cli.mitre.org

There it is stated that "The SAF CLI is the successor to Heimdall Tools and InSpec Tools." (ibid)

So, maybe take the opportunity to transform the merged Heimdall tools (indicated as deprecated on the original repo) into another name?

PPS:

In addition to my above comments on the name:

As an editor of the OASIS Common Security Advisory Framework (CSAF) Standard I hereby suggest to explore establishing liaisons between this planned data format TC, the OASIS CSAF TC, the OASIS SARIF TC, and others to avoid conflict or misalignment of related OASIS data format standards across overlapping areas of interest / communities.

All the best,

Stefan

Stefan Hagen, Individual