Re: attempted revised CPE spec
|
|
Drew, Thanks for sending the latest edition of the document. I've made some changes and added some comments. I used Track Changes so you'll be able to see all that I did. However, I'm a little worried about the expressive power of the string representation of the CPE language. It seems very rich, as currently defined in section 6.2, and I'm worried that it might be overkill (and difficult but not impossible to match against). Also, I'm worried that the current string rep is so different than the XML rep. Anyway, consider this CPE Language expression: cpe:/o:redhat:linux:[4:enterprise|5:[as|enterprise]]&a:mozilla:firefox:!1.5 This would be pretty torturous to express in the XML representation, and I'm not sure that's a bad thing. I can express my views more fully, maybe if we could have a telecon or something? The XML representation seems good to me at the moment, I'm just worried about whether the string and XML expression representations need to match up? BTW, I think we should make it our goal to have CPE 2.0 fully specified and ready to present at the SCAP workshop in September. Does that seem feasible? I look forward to seeing the comments from the NIST guy and Dave. ...nz (Neal Ziring, [hidden email], http://users.erols.com/ziring/) On Friday, July 13, 2007, at 07:16AM, "Buttner, Drew" <[hidden email]> wrote: >Thanks Neal. Here is the latest. Dave Waltermire and NIST are doing >the same review. I'll merge comments/changes and fill in any holes >that are left. If nothing too major comes up, I'll plan on sending >out a draft version to the list middle of next week. > >Thanks >Drew > > >>-----Original Message----- >>From: Neal Ziring [mailto:[hidden email]] >>Sent: Thursday, July 12, 2007 6:44 PM >>To: Buttner, Drew >>Subject: RE: attempted revised CPE spec >> >> >>Drew, >> >> I can't find the latest version of the document. Can you send it >>again? I'll look at it this weekend and get you feedback before >>Monday morning. >> >>...nz (Neal Ziring, [hidden email], http://users.erols.com/ziring/) >> >> >>On Friday, July 06, 2007, at 01:38PM, "Buttner, Drew" >><[hidden email]> wrote: >>>Neal, >>> >>>Hope you had a great 4th! Have you had a chance to look at the >>>proposed 2.0 spec any more? I can continue to wait for your comments >>>(desired) or we can push what we have so far to the community and see >>>what they have to say and role in your comments when you have time. >>> >>>Thanks >>>Drew >>> >>>>-----Original Message----- >>>>From: Neal Ziring [mailto:[hidden email]] >>>>Sent: Wednesday, June 20, 2007 12:48 AM >>>>To: Buttner, Drew >>>>Subject: Re: attempted revised CPE spec >>>> >>>> Drew, >>>> >>>> Sorry I didn't respond sooner, I was on a cruise as >>>>a family reunion. Right now I'm in the San Jose Hilton >>>>lobby on a TDY, using my personal Powerbook. It has >>>>no version of MS Word, but I was able to read the document >>>>using OpenOffice. >>>> >>>> I like your explanatory prose in the Language section, >>>>it makes the case for CPE Language effectively. I'm >>>>skeptical about some of the syntactic choices in the >>>>string representation; I was thinking that the semantics >>>>of the string representation and the XML representation >>>>would be the same, but I need to examine your >>>>draft more thoroughly. >>>> >>>> Don't worry about the Matching section. When we get >>>>some concensus on the rest of the document, I'll fill >>>>in that section. >>>> >>>> My battery is just about exhausted, so I'll send this. >>>>I'm going to try to join the call tomorrow for at least a >>>>little while, before going to some briefings here in San >>>>Jose. (Time difference working in my favor.) >>>> >>>>...nz >>>> >>>> >>>> >>>> >>>> >>>>On Jun 15, 2007, at 2:49 PM, Buttner, Drew wrote: >>>> >>>>> I have filled in the Language section. Thoughts? Having a >>>>tough time >>>>> with the matching section. Thought I would send you an update. >>>I'll >>>>> pick it up again next week. >>>>> >>>>> Thanks >>>>> Drew >>>>> >>>>> >>>>> >>>>>> -----Original Message----- >>>>>> From: Neal Ziring [mailto:[hidden email]] >>>>>> Sent: Tuesday, June 12, 2007 4:41 PM >>>>>> To: Buttner, Drew >>>>>> Subject: Re: attempted revised CPE spec >>>>>> >>>>>> >>>>>> Drew, >>>>>> >>>>>> Well, you've made some good progress on the new spec. >>>>>> I've tweaked a little, and added a few comments, but >>>>>> nothing substantial. I think you captured the intent >>>>>> from the telecon and Tom's URI recommendations pretty >>>>>> well. >>>>>> >>>>>> The use of the single letter to designate which >>>>>> domain the CPE Name is meaningful is pretty cool. You >>>>>> might want to say that other letters are reserved for >>>>>> future use (e.g. 'd' for driver, 's' for service). >>>>>> >>>>>> The language is going to be the tricky part, I >>>>>> suspect. Certainly it won't be hard to define an >>>>>> XML structure that supports AND, OR, and NOT. OVAL >>>>>> already has such a structure, and you can probably >>>>>> re-use those ideas. I'd like to advocate for a >>>>>> string representation of the language also, since >>>>>> that's effectively what a complex CPE name was; that >>>>>> way any complex CPE 1.1 Name string will be representable >>>>>> in CPE 2.0 as a single string. >>>>>> >>>>>> I also liked your tagged notation idea. It strikes me as >>>>>> somewhat similar to CMSI, although they had the rather >>>>>> complex notion of the set of allowable tags being >>>>>> contextual and based on content of prior tags. >>>>>> >>>>>> I'll be gone TDY, A/L and TDY again for the next >>>>>> week. I'll be able to get to my mac.com e-mail during >>>>>> that time, but not my thecouch.ncsc.mil e-mail. >>>>>> >>>>>> Thanks for the opportunity to review the spec draft. >>>>>> I'll support your efforts, and help in any way I can. >>>>>> >>>>>> ..nz >>>>>> >>>>>> >>>>>>> I have started the revision of the CPE spec. Namely, I have >>>>>> worked on >>>>>>> the first few sections. >>>>>>> >>>>>>> * change the syntax to only allow one part >>>>>>> * added a use case section >>>>>>> * added a terms section >>>>>>> * added the part component to fix double slash problem. >>>>>>> >>>>>>> I have not worked on the matching section, the new language >>>>>> section or >>>>>>> the description format. My plan is to attack them next. >>>>>>> >>>>>>> But I wanted to give you a copy of what I have done so far so I >>>can >>>>>>> make sure you are in agreement before sending this off to >>>>>> the list. I >>>>>>> have tried to reflect the opinions from the meeting, as well as >>>Tom >>>>>>> Jones' URI comments. You will notice that I did not use >>>>>> track changes >>>>>>> for this since the number of changes was so great. >>>>>>> >>>>>>> In short, can you read the first 5 sections and respond with any >>>>>>> comments? >>>>>>> >>>>>>> Also - should we take Todd's name off the top of the spec? >>>>>>> >>>>>>> Thanks >>>>>>> Drew >>>>>>> >>>>>>> --------- >>>>>>> >>>>>>> Andrew Buttner >>>>>>> The MITRE Corporation >>>>>>> [hidden email] >>>>>>> 781-271-3515 >>>>>>> >>>>>>> >>>>>> >>>>>> >>>>>> <cpe-specification_2.0_draft_20070615.doc> >>>> >>>> >>> >>> >> > > |
||||||||
cpe-specification_2.0_draft_20070715-nz_changes.doc (442K)
|
Folks,
Sorry to be slow getting back, been off line with a bug (biological). I include a few comments. I do have a concern / gut tightness about the attached which I think I can summarize as this: My vision for CPE would be to describe it as a system similar to chemistry, namely: * Atoms: smallest not divisible elements, this is below an element-molecule (i.e. O2 and O3 are both legitimate molecules of Oxygen). This may be the kernel of an OS or a specific chip on a motherboard or perphiral * Ions -- a non-stable (cannot exist by itself), such as H(+), for CO3(--). * Molecules: a stable configuration of elements, in our world, it may be a standard install of an OS. * Solution: a group of molecules that may be interacting, often there can be catalysts involved. ----------- up to this point, we are talking classic inorganic chemistry ------------------- * Organic System: in this case, we may have RNA replication and more elaborate interactions. What I see in the current description is that the 'base units' are equivalent to a 'chemical', in some cases we are talking Au (gold) and in other cases we are talking about Aqua Regia or more complex chemicals. The absence of consistancy or refineness causes me to become very uncomfortable -- the taxonomy feels very wrong and incomplete. Ken Lassesen, HomeOffice: 360-297-4717 Cell: 360-509-2402 Fax: 928-832-6836 IM: [hidden email] [hidden email] mailto:[hidden email] CONFIDENTIALITY NOTICE The information contained in this electronic message may contain confidential and privileged information and is intended only for use by the individual(s) or entity(ies) to whom it was addressed. Any unauthorized review, use, disclosure, or distribution of this communication is strictly prohibited. If you are not the intended recipient, please contact the sender by reply email and permanently delete and destroy the original message. |
||||||||
|
|
||||||||
|
In reply to this post
by Neal Ziring-2
|
||||||||
|
|
In reply to this post
by Tim Keanini Sr.
|
||||||||
| Free Embeddable Forum Powered by Nabble | Help |
