Hi y'all -
Please forgive my jumping in. Just want to provide you with a couple of notes in case it helps.
John-Mark asked about the mechanism for allowing public review feedback. That is covered by people subscribing to the cti-comment@ mailing list. They get a couple of notifications during that that their feedback is covered by the same IPR mode the TC conforms to. So that is tied to use of the -comment@ mailing list.
In setting up Open Repos and GitHub for TCs, we anticipated people would take advantage of the ability to fork repos, open or comment on issues, etc. Anyone who wants to make a substantive contribution can sign a CLA that has the same effect as the subscription notice above.
In addition, in the case of GitHubs for TCs, in "GitHub Repositories for OASIS TC Members' Chartered Work" (https://www.oasis-open.org/resources/tcadmin/github-repositories-for-oasis-tc-members-chartered-work), the last paragraph labelled "Substantive Contributions and Public Feedback" includes this statement:
"Public feedback on repository content is also accepted: persons who are not TC members are invited to open issues and provide comments using a TC Repository's GitHub Issues tracking facility or using the TC's comment list. All such content created in GitHub Issues and/or posted to the TC's archived comment list is governed by the terms of the OASIS Feedback License."
So we have covered public *feedback* there - if someone outside the TC issues a pull request against a TC GitHub, that is a different matter of course.
Please let me know if you'd like to discuss further.
Best,
/chet
On Thu, May 24, 2018 at 9:36 AM, Jason Keirstead <> wrote:
I am with Allan on this. If we can't accept
bug reports from non-TC members, this entire STIX Preferred effort is doomed
to failure.
I fail to see how reporting a bug or
change request on something like a test case is an IPR issue. There is
no IP here.
-
Jason Keirstead
STSM, Product Architect, Security Intelligence, IBM Security Systems
www.ibm.com/security
"Things may come to those who wait, but only the things left by those
who hustle." - Unknown
From:
Bret Jordan <>
To:
Allan Thomson <>,
"Back, Greg" <>, OASIS CTI TC list <>
Cc:
Interoperability Subcommittee
<>
Date:
05/24/2018 02:30 AM
Subject:
Re: [cti] Re:
[EXT] [cti-interoperability] Motion for Open Repository for CTI Interop
Issue Tracking
Sent by:
<>
The reason I think it needs to be a TC
Repo, is the issue tracker will track changes. Due to IPR rules,
I do not think we could take suggestions from non-TC members, aka, no bugs,
issues.
Bret
From: Allan Thomson <>
Sent: Wednesday, May 23, 2018 4:05:12 PM
To: Back, Greg; Bret Jordan; OASIS CTI TC list
Cc: Interoperability Subcommittee
Subject: Re: [cti] Re: [EXT] [cti-interoperability] Motion for Open
Repository for CTI Interop Issue Tracking
Our intention is interoperability (i.e.
STIXPreferred) is available to non-TC members to participate in. I can
imagine that non-TC specific information be available on the repo.
So I think it is appropriate in this case
that the repo is open rather than restricted to the TC.
Allan Thomson
CTO (+1-408-331-6646)
LookingGlass
Cyber Solutions
From: "Back, Greg" <>
Date: Wednesday, May 23, 2018 at 2:58 PM
To: Bret Jordan <>, Allan Thomson <>,
"" <>
Cc: Interoperability Subcommittee <>
Subject: Re: [cti] Re: [EXT] [cti-interoperability] Motion for Open
Repository for CTI Interop Issue Tracking
I’m fine with either, but I’ll point
out that a motion to create an open repo is very different from a motion
to create a TC repo. Based on what Allan is saying in the purpose statement,
it’s probably more suitable as a TC repo [1], using this form [2]. Again,
I would be in support of either one, though.
Thanks,
Greg
[1] https://www.oasis-open.org/resources/tcadmin/github-repositories-for-oasis-tc-members-chartered-work
[2] https://www.oasis-open.org/resources/tc-admin-requests/request-a-tc-github-version-control-instance-be-created
On 2018-05-22, 20:07, " behalf of Bret Jordan" < behalf of >
wrote:
I second this, however, I would suggest the name just
be cti-interop this way as an official work product repo, we could use
it for other interop related things. Yes, obviously, it will have
an issue tracker, but we could do other things with it as well.
Bret
From:
<> on behalf of Allan Thomson
<>
Sent: Tuesday, May 22, 2018 4:45:42 PM
To: OASIS CTI TC list
Cc: Interoperability Subcommittee
Subject: [EXT] [cti-interoperability] Motion for Open Repository for
CTI Interop Issue Tracking
I move that the TC approve by unanimous
consent requesting OASIS to set up an OASIS Open Repository named cti-interop-issuesusing the following pieces of information:
* Purpose Statement:
A CTI-Interoperability issue tracking repository
* Initial Maintainers:
Allan Thomson, Jason Keirstead
* Open Source License:
BSD-3-Clause License
* GitHub Name: cti-interop-issues
* Short Description:
OASIS Open Repository: CTI-Interop Issue Tracking
If there have been no objections by Friday,
25th May, 8am PST, I will submit the form [1] to request OASIS staff to
create the repository.
[1]: https://clicktime.symantec.com/a/1/O_ihu1E08Xl2-dCkw-ASiK6V6aRPMzaHPgA8JWCVguA=?d=uExWX7fZn2Kl6plF49kKe_LZP8lrMkLtXgjcy41DR0Fu0FSDcexzZAqC2nn1IMYh1vZ5FISBNpMlibp8Q0YGdjpkIAvhfVRjM1dsDF7cV4gT9qa8h0OjnyVkwC9MH38YSKD2lIHqyY8rhnZXjDuzWpBtp-VTHGRkjFV0W281F9vYddlnNEAE25ie-1Nhr0af-1LmnMK3x4VacBd2yc3UUhapIM5Pqqb-yRWtSq1ZVe0EGfmckl5y8-UwGLKOPkChB785CerSuPcODwZCi8FkAo5apC1IyU_dwL9khyfWaWdeH9AkaMHufWKd5VmISpiqqD5sPRcc9KLHxJQ_oIEHIjQQjQRnSPNRM6xRsDeD8nYOLsbdk6iZwtmXnnNOsf4riJlDR8Bh2-ZNEkQF5Kbql5CIO0Bj-vXyUHnKYHCAjWuD7fSaz6YXLfHN71fJx4whN1cAV3AA_F8MAUW8uP9AXd6s3VH576SP6yheifXsvXSPrvmnnX2t1VHrp2KdF36FZzPIqViSYyR4Mk5GEw%3D%3D&u=https%3A%2F%2Fwww.oasis-open.org%2Fresources%2Ftc-admin-requests%2Fopen-repository-request
Allan
--
/chet
----------------
Looking forward to Borderless Cyber 2018, 3-5 Oct, Washington, D.C.
Organized by The World Bank, OASIS, and Georgetown University
Chet Ensign
Chief Technical Community Steward
OASIS: Advancing open standards for the information society
http://www.oasis-open.org
Primary: +1 973-996-2298
Mobile: +1 201-341-1393
