The one problem with 'raw' indicators is the fact that they are exposed on the wire and can create a lot of alerts on SSL intercepting network IDS tools.
This fact can be mitigated by adding alert suppression on the network IDS to stop it alerting. This of course causes its own problems, as it means that if the TAXII server is compromised and starts communicating with malicious infrastructure it may not be detected by the network IDS due to its alert suppression.
That being said, I'm still not a fan of base64 encoding all indicators. We didn't do it in STIX v1.x and the internet didn't break. Network is could see the raw XML and we all coped OK. And it makes it simpler for people to build the tools and to learn, read and write the JSON -which is important in the early embryonic stages of a new standard such as this one.
My vote is to NOT base64 all the things on the wire.
Cheers
Terry MacDonald
