Subject: [sacm] SW M&A now on GitHub with current open issues

From: "Schmidt, Charles M." <[email-masked]>
Date: Thu, 6 Oct 2016 14:52:27 +0000

Hi all,

Danny Haynes and I have set up a GitHub repo for the SW M&A specification. (https://github.com/sacmwg/software-identification) This repo now has the latest specs along with several tracked issues. The issues listed are as follows:

1 - Identification of data sources in messages (discussed in IETF 94) - How should data sources for software information be reported
2 - Inclusion of Software Identifier in all reports (new issue) - It was suggested in conversation that a dedicated Software Identifier field should be present in all software reports. Currently (-02) software is reported either using a full record or a Software Identifier, but not both. However, this requires recipients to know how to derive Software Identifiers from the full records, and the procedure changes across data models. Having a dedicated Software Identifier field would absolve recipients of a significant dependency upon understanding the data model they receive.
3 - Identification of installation location of software (discussed in IETF 94) - Proposal for dedicated field recording the installation location of reported software (to the extent it is known). (Yes - some data models might include this information, but again this requires recipients to have the ability to parse this model, and no all models include this information in the first place. A dedicated field removes this dependency.)
4 - Support for vendor/user-defined data models (new issue) - The current (-02) draft of the specification uses an IANA table to provide an index that identifies the utilized data model. There has been a suggestion to allow vendors or users to specify data models other than those recorded in the IANA table to support proprietary extensions and local customizations.
5 - Clarify that SW M&A servers MUST accept all data models (new issue) - Within the scope of SW M&A, there is no dependency for servers to be able to parse the data models delivered to them. Given this lack of any technical dependency, it was suggested that it be made explicit that SW M&A servers accept any and all delivered data models without error.
6 - MTI data model(s) (discussed in IETF 94) - Which, if any, data models should be MTI in SW M&A? What does it mean for a data model to be MTI?
7 - What is the nature of reported software (discussed on-list in early August) - Currently (-02) SW M&A reports installed software. Some have noted that running software and installation packages (installed or not) on an endpoint are also of interest. The group should decide which classes of software presence SW M&A will monitor and report.

I believe this covers all open issues from prior meetings, mailing list discussions, and conversations to which I have been privy. Are there other issue that need to be discussed?

Recall that the group had an action item to review the latest SW M&A draft and raise issues for discussion at the virtual interim meeting on the 13th. If you have any questions or issues, please raise them on the mailing list so they can be captured.

Thanks a bunch,
Charles