Subject: Corrections proposed for IDMEF draft #7 (6/20/2002)

From: Cynthia McLain <[email-masked]>
Date: Fri, 06 Sep 2002 11:58:26 -0400

Hi Dave,

Changes were made to the UserId and Service XML
definitions between the December 2001 and June 2002
versions of the IDMEF internet draft (ie., versions
06 and 07). As I understand it, there was an issue
of 0-look-ahead non-determinism with the original
XML of the form: (a | b | (a,b)). The solution was
to use XML of the form (a?, b?) instead. Unfortunately,
the new definition does not require the presence of
a value whereas the previous definition did have
such a requirement.

I'd like to propose using the construct ((a,b?) | (b,a?)).
I believe this construct meets both the XML requirements
for determinism as well as the IDMEF goal of encouraging
interoperability.

If you (and others) agree, ((name, number?) | (number, name?))
would be used for UserId instead of (name?, number?)
and and ((name, port?) | (port, name?)) would be
used for Service instead of (name?, port?).

Thanks,
--Cindy

---

From: "David A. Curry" <[email-masked]>
Date: Fri, 06 Sep 2002 12:30:47 -0400

I agree with Cindy's proposal... it's better than what we put in the last
draft.

Unless someone has major objections (and if you do, please speak up now),
I will put Cindy's change into the next draft.

We're currently working (slowly) with the security area folks (Bellovin,
et al.) to get this stuff finalized.

--Dave

---

From: "Demchenko, Yuri" <[email-masked]>
Date: Fri, 06 Sep 2002 19:31:39 +0200

Just small observation in support of Cynthia's proposal to change
initial definition (a | b | (a,b)) that create problems when you try to
define schema as we are doing currently in IODEF.

We will look at this approach in description options/choices for similar
elements in IODEF as well.

Yuri