Subject: Re: [sacm] SWID and CPE discussion

From: Tony Rutkowski <[email-masked]>
Date: Sun, 10 Mar 2013 05:25:38 -0400

Almost everyone is shipping product with unique identifiers. What you need is an open means of using them. The world is not going to adapt to a funky ISO spec they cannot even read.

Sent from Samsung Mobile

-------- Original message --------
From: Gunnar Engelbach <[email-masked]> 
Date: 09/03/2013  19:36  (GMT-05:00) 
To: [email-masked] 
Cc: [email-masked] 
Subject: Re: [sacm] SWID and CPE discussion 

The other side of that is that some vendors are already shipping 
products that use SWID.  So, in some cases, SWID identifiers are already 
sitting there free for the using.

On 3/9/2013 5:37 PM, [email-masked] wrote:
>   Gunnar and all:
> I like Gunnar's point.
> Here's another observation.
> CPE has been very successful because the SCAP community has submitted
> probably most of the entries, and MITRE has worked with the vendors.
> In other words CPE enjoys the positive motivation of the SCAP community.
> Socializing SWID to software vendors probably presents a greater
> challenge if the vendor has to pay a fee.
> If vendors were to pay a fee for a CPE, or if CPE depended on the
> vendors submitting entries for their products, then CPE wouldn't be as
> successful.
> Gunnar's statement about OVAL now checking for duplicates is great.
> David Oliva
> On 03/08/13, Gunnar Engelbach<[email-masked]> wrote:
>
> It's also worth looking at whole role SWID/CPE is intended to fulfill
> within the scope of SACM.
>
> The two roles look to be inventorying and content applicability.
>
> In both cases the are at least two approaches: a dictionary-backed
> system or a deterministic rule-based system. Both devolve to a
> communicable token that is intended as an unambiguous identifier.
>
> The problems with a dictionary backed system has already been well
> stated on these threads.
>
> The rule-based approach is also problematic, as evidenced by the number
> of duplicate entries in the existing CPE dictionary, but does have the
> strength of being boot-strappable. That is to say, the rules are run to
> produce the token, and the token is then available for use. SCAP
> benchmarks use this mechanism to automatically determine applicability.
>
> The reason the CPE dictionary has so many duplicates is that the entries
> were created, for the most part, prior to OVAL checks written for each.
> Had the the CPE dictionary entries been created as the result of OVAL
> checks, or some other executable mechanism, there would have been little
> to no duplication, but with the side affect of having a dependency on
> that mechanism.
>
> What I don't recall seeing mentioned in regard to a dictionary-backed
> system is what to do when a software product is not bundled with a
> trustworthy SWID or CPE (or whatever) identifier. In that case it would
> still be necessary to fall back to a rule-based system to determine that
> identifier.
>
> Since both approaches devolve to a need for a rule-based system, then it
> seems reasonable to start with that. Unfortunately, that still means a
> dictionary of rule definitions, but that's what the content repositories
> are for, eh? In any case, I don't see a scenario where this is *not*
> necessary to do.
>
>
> --gun
>
>
>
>
>
> On 3/8/2013 2:41 PM, Moriarty, Kathleen wrote:
>  > Hi,
>  >
>  > SWID does have adoption as Dave pointed out and could scale better as
> it relies on vendors being responsible. As I understand it, you don't
> need to purchase the standard document to use it and TagVault may not be
> the only option. Someone mentioned that there may be a way for
> opensource efforts to get a SWID for free as well (not confirmed).
>  >
>  > Thanks,
>  > Kathleen
>  >
>  > -----Original Message-----
>  > From: [email-masked] <mailto:[email-masked]>
> [mailto:[email-masked]] On Behalf Of Tony Rutkowski
>  > Sent: Friday, March 08, 2013 2:09 PM
>  > To: Waltermire, David A.
>  > Cc: [email-masked] <mailto:[email-masked]>
>  > Subject: Re: [sacm] SWID and CPE discussion
>  >
>  > Hi Dave,
>  >
>  > The most significant question here is whether you
>  > are creating an open tagging scheme or not. In
>  > other words, is the ISO scheme only one of many
>  > tagging methods? If not, it's not conceivable that
>  > you would get acceptance.
>  >
>  > Furthermore, if you cannot provide the standard
>  > to show everyone that you want them to accept
>  > without paying $400 or more, you're unlikely to
>  > get traction down that path.
>  >
>  > Lastly, in weighing an open and free 3GPP
>  > Rel. 11 standard that gets baked into the global
>  > mobile infrastructure - against a virtually unused
>  > and unknown spec out of ISO, the result seems
>  > obvious.
>  >
>  > --tony
>  >
>  >
>  > On 3/8/2013 10:31 AM, Waltermire, David A. wrote:
>  >> I would say that ISO is a major standards body. I have been working
> with the TCG and other fora that are working on capabilities based on
> SWID. I know of a few major vendors that are already deploying SWIDs
> within their products (e.g. Microsoft, Adobe) and others that are
> working on it now.
>  >>
>  >>>>
>  >
>  >
>  > _______________________________________________
>  > sacm mailing list
>  > [email-masked] <mailto:[email-masked]>
>  > https://www.ietf.org/mailman/listinfo/sacm
>  >
>  > _______________________________________________
>  > sacm mailing list
>  > [email-masked] <mailto:[email-masked]>
>  > https://www.ietf.org/mailman/listinfo/sacm
>  >
> _______________________________________________
> sacm mailing list
> [email-masked] <mailto:[email-masked]>
> https://www.ietf.org/mailman/listinfo/sacm
_______________________________________________
sacm mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/sacm