Re: [sacm] IETF 95 Agenda on SWID world

Hi Tony,

I'm not deeply familiar with the SWID community -  I'm afraid I don't know enough about that space to unpack what you're referring to. Of the dozen other industry efforts you mention, can you suggest one or two that have the relevant properties and/or are widely deployed?

Regards,

Lisa

Lisa Lorenzin
Principal Solutions Architect, Pulse Secure
919-384-7275<tel:919-384-7275> | llorenzin@pulsesecure.net<mailto: llorenzin@pulsesecure.net>

Please pardon brevity - sent from my phone

------ Original message------

From: Tony Rutkowski

Date: Thu, Apr 7, 2016 09:01

To: Adam Montville;

Cc: ;

Subject:[sacm] IETF 95 Agenda on SWID world

Hi Adam,

Interesting to seem the presentations and
brainstorming on materials.  A few "inquiring
minds" questions.

For the Information Model Update presentation,
slide 9 portrays two SWIDS: "SWID XML Schema"
and "SWID CBOR Data Definition."  It's not clear
what the former represents, and the latter
presumably will eventually be revealed in
draft-birkholz-sacm-coswid-00.

The SWID CBOR effort usefully begins to head
slowly in the right direction of getting real, but it
refers to ISO/IEC 19770-2:2015 as the source
of SWID information structures, and combined
with ISO/IEC 19770-5:2013 also referenced, sets
one back $389 to take a peek at them.  Maybe that's
easy change for a government agency, but no one in
the real world is going to spend that amount to
take a peek at a specification.

  The problem here is compounded because NISTIR
8060 is out on the street for comment, but it references
the 2009 version.  To make matters worse, the NISTIR
references the 2015 version as an extension schema,
but the URL to get the extension schema is broken.
http://csrc.nist.gov/ns/swid/2015-extensions/1.0

Not that this isn't elegant work, but it has the surreal
attributes that pervaded the OSI world 30 years ago
where the previous generation of some of the same
government agency actors inhabited standards
meetings - writing for years some of the best
specifications that no one ever used.

There are at least a dozen other industry SWID
standards efforts out there if there was an interest
in looking.  They have better properties for the
context, and some of those are used on a significant
scale.  But then again, it's kind of fun watching the
deja vu of OSI getting reinvented in the IETF!

--tony

ps. If the authors revise the SWID CBOR draft, finding
the details of X.1520 is easy.  In English, it is at:
<https://www.itu.int/rec/dologin_pub.asp?lang=e&id=T-REC-X.1520-201401-I!!PDF-E&type=items>

_______________________________________________
sacm mailing list
sacm@ietf.org<mailto:sacm@ietf.org>
https://www.ietf.org/mailman/listinfo/sacm