Subject: [sacm] SWID Tags and Open Source Software

From: Steve Klos <[email-masked]>
Date: Tue, 02 Oct 2012 09:36:53 -0700

Jan,

SWID's apply to open source software in exactly the same way.  The XSD for the SWID tag is located here - http://standards.iso.org/iso/19770/-2/2009/.  The next version of the TagVault.org certification requirements will also be posted on the TagVault.org web site for everyone to download.  Finally, as the XSD is likely not quite sufficient for the use of open source developers, there is one piece of documentation missing - we essentially need to create a document that provides the descriptive information from 19770-2 in a freely downloadable document.

I can't provide specifics, but I can tell you that I know at least one installation tool for Windows software is very much promoting open source access to the SWID standard - including full support for PGP digital signatures.

If you're at the IT SAC conference, I'd love to catch up with you to learn more about the requirements you believe the open source community may have that SWID tags don't address...

Cheers,

SK

thanks to all for the comprehensive insights into SWID vs. CPE.

However, I come back to my original concerns, cited below, which so far remained mostly unanswered.

Most insights were about technical aspects. I still saw no argument why SWID is well compatible with Open Source community and vendor-independent approaches. CPE seems by far more competitive and compatible in this regard. At least I found no clarifying statements from SWID side. Maybe I did not manage to find it. At least such were not brought to attention in this thread.

I am starting to have doubts about the non-technical genes of SWID to solve the challenge of helpful product enumeration for security automation. If we only target a part of the IT industry, there will always be a gap in security coverage. It has to be filled with another concept and automatically we end up with two of them. Which in turn will make IT security more expensive for customers.

I'd really love to be prooven wrong with my pessimistic concerns!

All the best

Jan
Cheers,

SK
408.202.1900
--
Sent from a mobile device. Please excuse brevity and typos.

---

From: Lee Fisher <[email-masked]>
Date: Tue, 02 Oct 2012 11:09:21 -0700

Can the SWID specs be packaged up into a Debian package, or does the 
TagVault legal barriers prevent this? I think this is possible with 
SCAP, and SPDX, but not with SWID. Without base packages like this to 
depend on, then open source development isn't viable.

Where is data that clarifies what Open Source licenses are viable with 
content using the TagVault legal restrictions? Can I use GPLv2, v3, BSD, 
etc with my apps, and include a snapshot of the SWID markup files needed 
for my open source project?

I'm concerned about any IETF use of SWID standards, if you cannot freely 
access the spec and data without being forced to join their trade group. 
It seems a step backward from NIST SCAP, and IETF-style standards.

I'm also slightly6 concerned with the nontechnical (legal) heritage of 
SWID (copy protection) and SPDX (IP violations). Hopefully the metadata 
they create will be not be focused on the agenda of their creators. But 
with SPDX, the creators control the trade group, and force you to join 
and agree do help with their agenda... SCAP CPE does not have this legal 
legacy to deal with, and is strictly focused on technical issues (security).

On 10/2/12 9:36 AM, Steve Klos wrote:
[...]
> I can't provide specifics, but I can tell you that I know at least
> one installation tool for Windows software is very much promoting
> open source access to the SWID standard - including full support for
> PGP digital signatures.
[...]

It seems odd that open source access is being promoted, yet open source 
developers are not able to obtain specifics about how to participate in 
those promotions. Unless you mean some Windows-only product is going to 
someday promote Windows-only open source, once released. :-)