Subject: Re: [mile] review-- ROLIE Vulnerability Extension

From: "Banghart, Stephen A. (Fed)" <[email-masked]>
Date: Wed, 15 May 2019 16:13:11 +0000

Jess,

Thanks for the review. I’ve fixed your editorial notes.

In Section 6.2 I will be adding some property names, and have it fleshed out for the next version.
For the references in Section 8, I think that it’s a byproduct of how I’m handling my non-RFC references in the source XML. I’ll have to take a pass and patch it up.

Thanks,
Stephen

From: Jessica Fitzgerald-McKay <[email-masked]>
Sent: Friday, April 26, 2019 11:15 AM
To: Banghart, Stephen A. (Fed) <[email-masked]>; [email-masked]
Subject: review-- ROLIE Vulnerability Extension

I promised to review the ROLIE Vulnerability Extension during the MILE meeting in Prague. Comments are below. Please let me know if you have any questions.

Thanks,
Jess
--------------------------------------------------------------

Section 1--
    The sentence beginning "Today, a number of formats" is a run on sentence.

    Ditto the sentence beginning "This extension does not attempt".
Section 3--
    Paragraph 1-- change "as per" to "per"
    Paragraph 2-- s/"Provided below is a non-exhaustive list of information that may be considered to be of a vulnerability information type."/Below is a non-exhaustive list of information that may be considered vulnerability information."
    Last sentence of section 3 ("Note again that. . . ") is a run on sentence.
Section 4--
    Data Format Requirements-- you say "software descriptor" when I think you mean " vulnerability descriptor". Maybe a copy/paste error?
    Section 4.2.2- s/"utilize"/"used"
Section 6.2-- will you be asking for any new rolie:property names? If so, I would at least create a TBD section here, as a placeholder.
Section 8-- this is super nitpicky, even for me, but is there a reason to use lower case references? It stuck me as unconventional, particularly since you capitalize the RFC references.