Re: [sacm] IETF 95 Agenda on SWID world

[Adam Montville <[e-mail]>]

Tony,

Thanks for your comments, insights, and references.  I think SWID is a starting point, as any reasonable engineer would recognize that no single software identification standard will get security automation across the goal line.

To clarify the SWID XML/CBOR confusion, that was an example of the boundaries between information models, data models, and serializations.  If you have an opportunity, you should review the MeetEcho recording.

Kind regards,

Adam

> On Apr 7, 2016, at 9:00 AM, Tony Rutkowski <[e-mail]> wrote:
> 
> Hi Adam,
> 
> Interesting to seem the presentations and
> brainstorming on materials.  A few "inquiring
> minds" questions.
> 
> For the Information Model Update presentation,
> slide 9 portrays two SWIDS: "SWID XML Schema"
> and "SWID CBOR Data Definition."  It's not clear
> what the former represents, and the latter
> presumably will eventually be revealed in
> draft-birkholz-sacm-coswid-00.
> 
> The SWID CBOR effort usefully begins to head
> slowly in the right direction of getting real, but it
> refers to ISO/IEC 19770-2:2015 as the source
> of SWID information structures, and combined
> with ISO/IEC 19770-5:2013 also referenced, sets
> one back $389 to take a peek at them.  Maybe that's
> easy change for a government agency, but no one in
> the real world is going to spend that amount to
> take a peek at a specification.
> 
> The problem here is compounded because NISTIR
> 8060 is out on the street for comment, but it references
> the 2009 version.  To make matters worse, the NISTIR
> references the 2015 version as an extension schema,
> but the URL to get the extension schema is broken.
> http://csrc.nist.gov/ns/swid/2015-extensions/1.0
> 
> Not that this isn't elegant work, but it has the surreal
> attributes that pervaded the OSI world 30 years ago
> where the previous generation of some of the same
> government agency actors inhabited standards
> meetings - writing for years some of the best
> specifications that no one ever used.
> 
> There are at least a dozen other industry SWID
> standards efforts out there if there was an interest
> in looking.  They have better properties for the
> context, and some of those are used on a significant
> scale.  But then again, it's kind of fun watching the
> deja vu of OSI getting reinvented in the IETF!
> 
> --tony
> 
> ps. If the authors revise the SWID CBOR draft, finding
> the details of X.1520 is easy.  In English, it is at:
> <https://www.itu.int/rec/dologin_pub.asp?lang=e&id=T-REC-X.1520-201401-I!!PDF-E&type=items>
> 
> 
> 
> 
>