Subject: Finishing Off IDWG

From: Mike Erlinger <[email-masked]>
Date: Mon, 6 Feb 2006 20:00:43 -0800

Hi Everyone

IDWG was on my list of things to do after the New Year.  Sam Hartman,
the Security Area Director beat me to it.  Basically, the IDWG Working
Group has been idle for over a year; IDMEF is still an Internet Draft;
the IESG has issues with the use of both DTD and Schemas in IDMEF.

Herve Debar, the primary author of IDMEF, is willing to make changes
recommended by the IESG.  He has sent out email to the list asking
for information about the use of IDMEF and whether a DTD or Schema
is the better choice.  He will use the responses to drive a new
document.  Once we have a new document, Sam will assist
us in getting IDMEF published as an Experimental RFC.  This would
finish the IDWG Working Group efforts and the Working Group would
be closed.

So, very soon Herve will post a new Internet Draft to the mailing
list.  I will then post the ID to the ID database.  Once this is
done, I would ask people to read the document and post any typo
issues (since IDMEF passed a Working Group last call and was
forwarded to the AD and IESG, we are past making serious
modifications to the IDMEF, except as directed by the IESG).

Once the Working Group is happy with the document, I would ask
that it be published as an Experimental RFC.

mike

-- 
Mike Erlinger, Professor and Chair Computer Science
www:      http://www.cs.hmc.edu/~mike
email:    [email-masked]
smail:    Computer Science Dept., Harvey Mudd College,
          301 E. 12th Street, Claremont, CA, 91711 
          909-621-8912,   FAX: 909-607-8364
"As for the future, your task is not to foresee, but to enable it"

---

From: "Eric D. Williams" <[email-masked]>
Date: Fri, 10 Feb 2006 16:29:31 -0500

----- Original Message ----- 
From: "Mike Erlinger" <[email-masked]>
To: "intrusion detection wg" <[email-masked]>
Sent: Monday, February 06, 2006 11:00 PM
Subject: Finishing Off IDWG

> the IESG has issues with the use of both DTD and Schemas in IDMEF.

Thanks Mike.

I concur, all that is left in fact is to get the 'official' stuff marked up.
IU am all for that.

> document.

I think Schema can be normative and prefer the -15 draft.
Information Brokers, uses IDMEF as a teaching tool, so I guess "academic"
is appropriate as usage.

8<.snip.>8

> that it be published as an Experimental RFC.

Stellar!

-e

Eric Williams, Pres.
Information Brokers, Inc.    Phone: +1 202.889.4395
http://www.infobro.com/        Fax: +1 202.889.4396
[email-masked]                Pager: +1 301.303.8998
           For More Info: [email-masked]
                    PGP Public Key
   http://new.infobro.com/KeyServ/EricDWilliams.asc
Finger Print: 1055 8AED 9783 2378 73EF  7B19 0544 A590 FF65 B789
----------------------------------------------------------------
The information in this message is confidential.  It is intended
solely for addressee(s).  Access to this message by anyone else
is unauthorized.  If you are not the intended recipient, any
disclosure, copying, distribution or any action taken or omitted
to be taken in reliance on it, is prohibited and may be unlawful.