Subject: [mile] An alternative way to represent a URL

From: "Roman D. Danyliw" <[email-masked]>
Date: Thu, 16 Jan 2014 18:56:37 +0000

Hello,

The schema definition of the Node class in -03 of 5070bis has the following comment in it:

[begin schema snippet]
<!-- Proposed CHANGE: include a URI indicator.
       Common complaint that URIs were only in the 
        IODEF schema as references and not part of the
        incident or included indicators. 
        Included right now as an address type, below is a 
        second option for how to add it.
   <xs:element ref="iodef:URL"
                        minOccurs="0" maxOccurs="unbounded"/>
 -->
[end schema snippet]

This proposal would provide an alternative to the current approach of representing a URI for a Node using Address@category="site-uri" (e.g., <Address category="site-uri">http://www.example.com/sites/foo</Address>).

I don't know the origin or rational for this comment.  Could anyone shed light on why we'd want to change the current representation?

Roman

---

From: "Moriarty, Kathleen" <[email-masked]>
Date: Thu, 16 Jan 2014 15:02:19 -0500

Hi Roman,

I think it was only left in to show that we could do this another way if people were interested.  If the WG is happy with the approach in place now that achieves the same objective, this can be removed.  The discussions that led to this may go back to Rosella's presentation and that URLs could only be included as a reference and not an indicator in IODEF v1.

Thanks,
Kathleen

-----Original Message-----
From: mile [mailto:[email-masked]] On Behalf Of Roman D. Danyliw
Sent: Thursday, January 16, 2014 1:57 PM
To: [email-masked]
Subject: [mile] An alternative way to represent a URL

Hello,

[begin schema snippet]
                        minOccurs="0" maxOccurs="unbounded"/>  --> [end schema snippet]

Roman
_______________________________________________
mile mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/mile

---

From: Eric Burger <[email-masked]>
Date: Thu, 23 Jan 2014 11:49:00 -0500

One and only one way to indicate a Thing sounds good to me. I would remove the reference, as it does not change 5070 at all and it also removes the temptation to implement in another, not-quite-compatible format.

---

From: "Moriarty, Kathleen" <[email-masked]>
Date: Thu, 23 Jan 2014 12:48:31 -0500

Hi Eric,

We need to include URLs that are references in addition to the newly added ability to include a URL that is an indicator.  The URL as a reference could include a description of malware or a type of attack, etc.  my quick mention of URL as a reference was not clear on that point.  

Thanks,
Kathleen 

Sent from my iPhone

> On Jan 23, 2014, at 11:49 AM, "Eric Burger" <[email-masked]> wrote:
> 
> <signature.asc>

---

From: Eric Burger <[email-masked]>
Date: Fri, 24 Jan 2014 06:36:19 -0500

Sorry I was not clear. By “remove the reference” I did not mean to remove URL’s as an indicator. I meant to answer Roman’s question about keeping the reference to “another way” of representing URL’s in IODEF.

So, keep URL’s, but remove the *comments* about other ways of specifying them.