Re: Bringing IDWG to closure

Sam,

[sorry for the delay, I was unavailable last week.]

Sam Hartman wrote:

>[My postings to the list do not seem to be accepted.  I'd appreciate
>it if the chairs could forward this to the list and add me to the
>accepted senders.]
> =20
>
I think your post made it to the list.

>
>Hi.  I sent a probe out about the status of the IDMF document at the
>end of November and received some indications that the authors would
>try to work on the document during December.  I have not heard
>anything since then.
> =20
>
This did happen. I believe that we have an almost final document for=20
IDMEF. Mike Erlinger currently has the document. I will forward it to=20
you via a separate mail.

>In the interest of not having this process draw out for ever, I'm
>establishing a concrete deadline.  One of two things must happen by
>February 7, 2005, the first scheduling deadline for IETF 62.
>
>First, an IDMF document can be presented along with changes since the
>last version.  This document needs to be accompanied by a statement of
>what review it has received and an assertion by the chairs that they
>believe this review is adequate for publication.
> =20
>
I am sending you the document. It has been reviewed and implemented by 2=20
open source projects, libidmef / snort IDMEF output plugin and prelude=20
(http://www.prelude-ids.org). It is also used in many research=20
prototypes (CRIM, DIAMS, ...) and as such referenced in numerous=20
research papers (you can find these references in citeseer for example).=20
There are also at least 2 research papers proposing extensions to the=20
document.

The final document is (IMO) the one I'm sending you minus the sections:
- DTD (superseded by the schema)
- XML tutorial
- Change tracking.

>If it looks like getting the document in final shape by this deadline
>is problematic, there is another option.  The chairs can work with me
>to set up a series of milestones providing for completion of the
>document and for adequate review.  These milestones would need to be
>established by February 7.
>
>
>If neither of these things happen by February 7, I will conclude that
>there is not sufficient interest to finish this work and close down
>the working group.  If there is some reason that February 7 is not a
>reasonable deadline--for example a critical stakeholder is on vacation
>until then--propose an alternate deadline as soon as possible.
> =20
>
I'll do my best, but I had emergency surgery last week and I will be=20
unable to travel for quite a while. I'll be reading mail and working on=20
the document tough.

Herv=E9

--=20
Herv=E9 Debar             <mailto:[email protected]>
Tel: +33 (0)2 31 75 92 61            GSM: +33 (0)6 74 09 09 66
France T=E9l=E9com R&D                   Fax: +33 (0)2 31 75 93 13
42 rue des Coutures  (--)  BP 6243  (--)  F-14066 Caen Cedex 4