Re: [mile] Consensus Call - SCI draft MMDEF as MTI

"Takeshi Takahashi" <takeshi_takahashi@nict.go.jp> Mon, 01 April 2013 08:53 UTC

Return-Path: <takeshi_takahashi@nict.go.jp>
X-Original-To: mile@ietfa.amsl.com
Delivered-To: mile@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7215A21F8881 for <mile@ietfa.amsl.com>; Mon, 1 Apr 2013 01:53:23 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: 1.245
X-Spam-Level: *
X-Spam-Status: No, score=1.245 tagged_above=-999 required=5 tests=[BAYES_50=0.001, HELO_EQ_JP=1.244]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kD4-pSFXaXdQ for <mile@ietfa.amsl.com>; Mon, 1 Apr 2013 01:53:22 -0700 (PDT)
Received: from ns1.nict.go.jp (ns1.nict.go.jp [IPv6:2001:df0:232:300::1]) by ietfa.amsl.com (Postfix) with ESMTP id 35C2421F88C0 for <mile@ietf.org>; Mon, 1 Apr 2013 01:53:21 -0700 (PDT)
Received: from gw1.nict.go.jp (gw1 [133.243.18.250]) by ns1.nict.go.jp with ESMTP id r318rFN2001843; Mon, 1 Apr 2013 17:53:15 +0900 (JST)
Received: from gw1.nict.go.jp (localhost [127.0.0.1]) by gw1.nict.go.jp with ESMTP id r318rETn010399; Mon, 1 Apr 2013 17:53:14 +0900 (JST)
Received: from mail3.nict.go.jp (mail.nict.go.jp [133.243.18.3]) by gw1.nict.go.jp with ESMTP id r318rEJE010395; Mon, 1 Apr 2013 17:53:14 +0900 (JST)
Received: from mail3.nict.go.jp (localhost [127.0.0.1]) by mail3.nict.go.jp (NICT Mail) with ESMTP id 6E9F0164B3; Mon, 1 Apr 2013 17:53:14 +0900 (JST)
Received: from VAIO (unknown [133.243.119.109]) by mail3.nict.go.jp (NICT Mail) with ESMTP id 68F6C16473; Mon, 1 Apr 2013 17:53:14 +0900 (JST)
From: Takeshi Takahashi <takeshi_takahashi@nict.go.jp>
To: "'Moriarty, Kathleen'" <kathleen.moriarty@emc.com>, mile@ietf.org
References: <F5063677821E3B4F81ACFB7905573F24D79BE5CD@MX15A.corp.emc.com>, <1C9F17D1873AFA47A969C4DD98F98A751926C4@xmb-rcd-x10.cisco.com> <F5063677821E3B4F81ACFB7905573F24D79BE5F0@MX15A.corp.emc.com> <8D3D17ACE214DC429325B2B98F3AE71290FA9202@MX15A.corp.emc.com> <000601ce279e$c8ab7940$5a026bc0$@nict.go.jp> <F5063677821E3B4F81ACFB7905573F24DA7FE484@MX15A.corp.emc.com>
In-Reply-To: <F5063677821E3B4F81ACFB7905573F24DA7FE484@MX15A.corp.emc.com>
Date: Mon, 01 Apr 2013 17:53:21 +0900
Message-ID: <006b01ce2eb6$5ca18d60$15e4a820$@nict.go.jp>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
X-Mailer: Microsoft Outlook 14.0
Thread-Index: AQFCibkFcoiRAxGJUwOvO7kpytpEUwHYmM6bAq+IVDUBugT0/gGrVkJYAnN+UnOZhU9p0A==
Content-Language: ja
Subject: Re: [mile] Consensus Call - SCI draft MMDEF as MTI
X-BeenThere: mile@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: "Managed Incident Lightweight Exchange, IODEF extensions and RID exchanges" <mile.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/mile>, <mailto:mile-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/mile>
List-Post: <mailto:mile@ietf.org>
List-Help: <mailto:mile-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/mile>, <mailto:mile-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 01 Apr 2013 08:53:23 -0000

Hello all,

Thank you for your kind support to the draft.

Before the draft goes to the WGLC, we are currently reviewing the content of
the draft once again.
Let me update the draft and come back to the mailing list with revised
version in a couple of weeks.

Thank you.
Take


> -----Original Message-----
> From: Moriarty, Kathleen [mailto:kathleen.moriarty@emc.com]
> Sent: Thursday, March 28, 2013 9:59 AM
> To: Takeshi Takahashi; mile@ietf.org
> Subject: RE: [mile] Consensus Call - SCI draft MMDEF as MTI
> 
> Hello,
> 
> Thank you for voicing your opinions at the MILE meeting, the two week
period
> is up and we have full agreement.  We will move forward with MMDEF as the
> MTI for the SCI draft.
> 
> Take - Thank you for updating the draft to include MMDEF as the MTI as
well
> as the update below.  Could you expand the acronym for MTI in the draft
> and update the version to the latest?
> 
> Bets regards,
> Kathleen
> 
> -----Original Message-----
> From: mile-bounces@ietf.org [mailto:mile-bounces@ietf.org] On Behalf Of
> Takeshi Takahashi
> Sent: Saturday, March 23, 2013 4:17 AM
> To: mile@ietf.org
> Subject: Re: [mile] Consensus Call - SCI draft MMDEF as MTI
> 
> Hi all,
> 
> I remember the discussion on the EICAR and agree upon David's kind
> suggestion.
> The attached is the revised SCI draft, whose section 10 talks about the
> EICAR (with an example XML).
> 
> Kind regards,
> Take
> 
> 
> > -----Original Message-----
> > From: mile-bounces@ietf.org [mailto:mile-bounces@ietf.org] On Behalf
> > Of Black, David
> > Sent: Thursday, March 14, 2013 11:54 PM
> > To: Moriarty, Kathleen; mile@ietf.org
> > Subject: Re: [mile] Consensus Call - SCI draft MMDEF as MTI
> >
> > I support MMDEF as the MTI, and since MMDEF is a malware spec, I'd
> > like to resurrect a previously-discussed suggestion that the SCI draft
> > include discussion of the "EICAR Standard Anti-Virus Test File" as a
> > specific
> example
> > that SHOULD (or MUST?) be supported for black-box testing purposes.
> >
> > See: http://www.eicar.org/86-0-Intended-use.html
> >
> > Thanks,
> > --David
> >
> > > -----Original Message-----
> > > From: mile-bounces@ietf.org [mailto:mile-bounces@ietf.org] On Behalf
> > > Of Moriarty, Kathleen
> > > Sent: Thursday, March 14, 2013 10:38 AM
> > > To: Panos Kampanakis (pkampana); mile@ietf.org
> > > Subject: Re: [mile] Consensus Call - SCI draft MMDEF as MTI
> > >
> > > Hello Panos,
> > >
> > > Thank you for joining us remotely!  The recording is available for
> > > those who were not able to attend during the session.
> > >
> > > We need to choose one included schema as MTI for 'black box' testing
> > > of the method described.  Essentially, if you can exchange using the
> > > MTI spec, then any other specs supported should theoretically work
> > > as the pattern has been established.
> > >
> > > MMDEF was recommended as it is in use by the eCrime WG as an
> > extension
> > > to IODEF/RFC5901.  It replaced the method to include malware in
> > > exchanges and seemed to make sense to adopt more broadly as it is
> > > maintained by a group in IEEE focused on that particular problem.
> > >
> > > BTW, I meant to say the last call will end in two weeks from
> > > yesterday, Wednesday March 27th.
> > >
> > > Thank you!
> > > Kathleen
> > > ________________________________________
> > > From: Panos Kampanakis (pkampana) [pkampana@cisco.com]
> > > Sent: Thursday, March 14, 2013 9:59 AM
> > > To: Moriarty, Kathleen; mile@ietf.org
> > > Subject: RE: Consensus Call - SCI draft MMDEF as MTI
> > >
> > > I agree with MMDEF included in SCI.
> > > I am not sure why it must be MTI. Due to some audio problems I
> > > missed part of the call yesterday. Can you briefly summarize why we
> > > want it
> MTI?
> > >
> > > -----Original Message-----
> > > From: mile-bounces@ietf.org [mailto:mile-bounces@ietf.org] On Behalf
> > > Of Moriarty, Kathleen
> > > Sent: Wednesday, March 13, 2013 3:04 PM
> > > To: mile@ietf.org
> > > Subject: [mile] Consensus Call - SCI draft MMDEF as MTI
> > >
> > > Hello,
> > >
> > > In today's MILE session, a call for consensus began to include MMDEF
> > > in the SCI draft as the mandatory-to-implement (MTI) specification.
> > > The call for consensus will last for 2 weeks and we ask that you
> contribute
> > your opinion.
> > > The vote in the room was unanimous and we want to make sure we hear
> > > from participants not in attendance.
> > >
> > > Poll will end on Wednesday next week.
> > >
> > > Thank you!
> > > Kathleen
> > > _______________________________________________
> > > mile mailing list
> > > mile@ietf.org
> > > https://www.ietf.org/mailman/listinfo/mile
> > > _______________________________________________
> > > mile mailing list
> > > mile@ietf.org
> > > https://www.ietf.org/mailman/listinfo/mile
> >
> > _______________________________________________
> > mile mailing list
> > mile@ietf.org
> > https://www.ietf.org/mailman/listinfo/mile