Re: [sacm] IETF 95 Agenda on SWID world

Just to correct the record:

* NIST IR 8060 is currently available in its fourth public draft for comment. The final draft is due imminently.

* IR 8060 cites the 2009 version of the SWID spec, but clearly states (first sentence, second paragraph, Introduction) that "This 
report provides an overview of the capabilities and usage of SWID tags defined by the ISO/IEC 19770-2:2015 standard."

* IR 8060 does not "[reference] the 2015 version as an extension schema". We introduce an extension schema to support a handful of guidelines in the IR. The link to that schema is broken until the final version of the IR is published.

With that, I need to get back to reinventing decades-old work.

/Brant

P.S. The relevance of X.1520 (common vulnerabilities and exposures) to SWID CBOR needs to be clarified. -b

-----Original Message-----
From: sacm [mailto:sacm-bounces@ietf.org] On Behalf Of Tony Rutkowski
Sent: Thursday, April 07, 2016 8:01 AM
To: Adam Montville <adam.w.montville@gmail.com>
Cc: <sacm@ietf.org> <sacm@ietf.org>
Subject: [sacm] IETF 95 Agenda on SWID world

Hi Adam,

Interesting to seem the presentations and brainstorming on materials.  A few "inquiring minds" questions.

For the Information Model Update presentation, slide 9 portrays two SWIDS: "SWID XML Schema"
and "SWID CBOR Data Definition."  It's not clear what the former represents, and the latter presumably will eventually be revealed in draft-birkholz-sacm-coswid-00.

The SWID CBOR effort usefully begins to head slowly in the right direction of getting real, but it refers to ISO/IEC 19770-2:2015 as the source of SWID information structures, and combined with ISO/IEC 19770-5:2013 also referenced, sets one back $389 to take a peek at them.  Maybe that's easy change for a government agency, but no one in the real world is going to spend that amount to take a peek at a specification.

  The problem here is compounded because NISTIR
8060 is out on the street for comment, but it references the 2009 version.  To make matters worse, the NISTIR references the 2015 version as an extension schema, but the URL to get the extension schema is broken.
http://csrc.nist.gov/ns/swid/2015-extensions/1.0

Not that this isn't elegant work, but it has the surreal attributes that pervaded the OSI world 30 years ago where the previous generation of some of the same government agency actors inhabited standards meetings - writing for years some of the best specifications that no one ever used.

There are at least a dozen other industry SWID standards efforts out there if there was an interest in looking.  They have better properties for the context, and some of those are used on a significant scale.  But then again, it's kind of fun watching the deja vu of OSI getting reinvented in the IETF!

--tony

ps. If the authors revise the SWID CBOR draft, finding the details of X.1520 is easy.  In English, it is at:
<https://www.itu.int/rec/dologin_pub.asp?lang=e&id=T-REC-X.1520-201401-I!!PDF-E&type=items>

_______________________________________________
sacm mailing list
sacm@ietf.org
https://www.ietf.org/mailman/listinfo/sacm