Re: [sacm] IETF 95 Agenda on SWID world

[Tony Rutkowski <[e-mail]>]

Hi Adam,

My apologies for being irreverent, but watching
this OSI SC7 SWID effort unfold over the past ten
years is like watching OSI unfolding in the 1980s.
It's like malware that has now infected the IETF.

There are multiple ways of accomplishing the
objective within the industry today.  You need to
begin to look at how this is being done and how those
different approaches can be made to interoperate
without trying to cram it all into a hopeless ISO
standard with (from what I can tell) 105 different
xml data elements and 43 complex types.

Just as it was in the 1980s, it's a waste of good
talent and resources.

--tony

On 2016-04-07 8:28 AM, Adam Montville wrote:
> Tony,
>
> Thanks for your comments, insights, and references.  I think SWID is a starting point, as any reasonable engineer would recognize that no single software identification standard will get security automation across the goal line.
>
> To clarify the SWID XML/CBOR confusion, that was an example of the boundaries between information models, data models, and serializations.  If you have an opportunity, you should review the MeetEcho recording.
>
> Kind regards,
>
> Adam