Subject: [sacm] A thought and three related questions regarding the SWID M&A draft

From: Lisa Lorenzin <[email-masked]>
Date: Mon, 21 Mar 2016 18:13:40 +0000

Hi all,

I must admit I was a little overwhelmed by all the OVAL drafts that were posted for the virtual interim!  Looking back at the virtual interim notes, it looks like we agreed to focus our reviews first on the Endpoint Compliance Profile and SWID Message and Attributes drafts, which was a bit of a relief. :)  So I've been thinking about SWID M&A in relation to the vulnerability assessment scenario.

One thought that occurs to me is that the current SWID M&A draft addresses XML formatted messages and assumes an XML binding; I've gotten a good less in the pitfalls of having XML as the only standard binding from my work with TNC IF-MAP, and I think it's a good idea to have more options in this arena.  I'd like us to consider additional encoding options - JSON and CBOR seem like two obvious choices to me - and adding some kind of negotiation to enable selection among them.

Three questions:

1) Does this seem useful?  Are there pitfalls I'm not considering to expanding beyond one binding?

2) If we do expand to multiple encoding options, what mechanism(s) would be most appropriate in this usage for negotiation of which encoding option to use?

3) Are there additional encoding options beyond JSON and CBOR that should be considered?  Since this is outside my primary experience, I'd love to hear what others think should be included.

							Regards,

								Lisa

-- 
Lisa Lorenzin    /    Principal Solutions Architect
[email-masked]    /    919-384-7275

Pulse Secure    /    https://www.pulsesecure.net
Facebook: https://www.facebook.com/pulsesecure1
LinkedIn: https://www.linkedin.com/company/pulse-secure
Twitter: https://twitter.com/PulseSecure1

---

From: Lisa Lorenzin <[email-masked]>
Date: Mon, 21 Mar 2016 18:31:55 +0000

Typo correction:
"I've gotten a good less in the pitfalls" should read "I've gotten a good lesson in the pitfalls" - my apologies for the error.

Regards,
Lisa

------Original Message-----
From: sacm [mailto:[email-masked]] On Behalf Of Lisa Lorenzin
Sent: Monday, March 21, 2016 2:14 PM
To: [email-masked]
Subject: [sacm] A thought and three related questions regarding the SWID M&A draft

Hi all,

Three questions:

							Regards,

								Lisa

_______________________________________________
sacm mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/sacm