cti-stix — archive

Re: [cti-stix] Unicode, strings, and STIX

From: John Wunder <[email protected]>
To: [email protected]
Date: Tue, 07 Jun 2016 17:03:00 -0000

We had some more discussion of this on the working call (very brief, at the very end) and the conversation seems to have shifted back to just removing all of the normative statements regarding length. So, at this point, let’s do this: 1. Are there any objections to removing all of the normative statements regarding string field lengths from the specification? Please respond to this e-mail on the list if you object. 2. Assuming we hear objections, let’s open a ballot on the topic. I’ll work with JMG and others to get the ballot text and make the motion to open it. John From: <[email protected]> on behalf of "Jordan, Bret" <[email protected]> Date: Friday, June 3, 2016 at 2:33 PM To: Mark Davidson <[email protected]> Cc: Jason Keirstead <[email protected]>, John-Mark Gurney <[email protected]>, "[email protected]" <[email protected]>, Terry MacDonald <[email protected]>, Rich Piazza <[email protected]>, "[email protected]" <[email protected]> Subject: Re: [cti-stix] Unicode, strings, and STIX Based on a conversation we have had on slack, I would propose some text like this: Title fields SHOULD be between 1-256 characters. Title fields MAY be longer than 256 characters. For non-English languages you SHOULD measure characters as code-points. Thanks, Bret Bret Jordan CISSP Director of Security Architecture and Standards Office of the CTO Blue Coat Systems PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 "Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg." On Jun 3, 2016, at 08:57, Mark Davidson < [email protected] > wrote: If we have no limits and a Soltra Edge user creates a 100GB title and $compatible-product falls over – how does that get resolved? If I was being snotty I would say “well, $compatible-product isn’t fully standards compliant”, even though I think that would be against the spirit of the spec. I do think we should specify limits somehow. Either through a required minimum, a recommended maximum, or something. IMO, the purpose is to give implementers _ something _ to work with without having to make wild guesses about what will be available in the ecosystem. The ability to specify the maximum (e.g., code points, graphemes, and other things I don’t understand well) is IMO a separate conversation. I think step #1 is whether we as a group think specifying limits (one way or another) make sense. I would in general say yes, and the arguments to the contrary haven’t swayed me. However, if we don’t want limits, we should just have a piece of informative text stating that there are no limits and why we chose that. Thank you. -Mark From: < [email protected] > on behalf of Jason Keirstead < [email protected] > Date: Friday, June 3, 2016 at 8:00 AM To: "Jordan, Bret" < [email protected] > Cc: John-Mark Gurney < [email protected] >, " [email protected] " < [email protected] >, Terry MacDonald < [email protected] >, Rich Piazza < [email protected] >, " [email protected] " < [email protected] > Subject: Re: [cti-stix] Unicode, strings, and STIX My question is - what are you supposed to do with that information? - You can't take that limit and turn it into a byte limit for buffer purposes - it is not possible. You can't even guess because it depends both on the character encoding as well as the language. Since the character encoding is not part of STIX but part of the serialization binding, trying to figure out the number of bytes a given number of code points will consume is a bit of a fools errand. - You also can't take that limit and use it in your GUI in any way, because you can't enforce length limits of input fields based on code points - you have to do it based on graphemes/glyphs. So.. what are people planning to use this limit for? - Jason Keirstead STSM, Product Architect, Security Intelligence, IBM Security Systems www.ibm.com/security www.securityintelligence.com Without data, all you are is just another person with an opinion - Unknown <image001.gif> "Jordan, Bret" ---06/02/2016 08:35:22 PM---To me it just feels wrong or dirty to not have some sort of guidance or some sort of upper limit. I From: "Jordan, Bret" < [email protected] > To: John-Mark Gurney < [email protected] >, " [email protected] " < [email protected] > Cc: Jason Keirstead/CanEast/IBM@IBMCA, Terry MacDonald < [email protected] >, Rich Piazza < [email protected] >, " [email protected] " < [email protected] > Date: 06/02/2016 08:35 PM Subject: Re: [cti-stix] Unicode, strings, and STIX Sent by: < [email protected] > To me it just feels wrong or dirty to not have some sort of guidance or some sort of upper limit. I am not saying the lengths have to be really short.... We could say a title can have up to 256 code points or 512 code points, but the fact is, we should define something, I think... I have asked Eric, our resident academic to chime in, and he will give us some guidance hopefully tomorrow. Thanks, Bret Bret Jordan CISSP Director of Security Architecture and Standards Office of the CTO Blue Coat Systems PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 "Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg." [attachment "signature.asc" deleted by Jason Keirstead/CanEast/IBM]