Re: Required changes to draft-ietf-idwg-idmef-xml-14

Sam,

thanks for the feedback. Comments and answers below.

Sam Hartman wrote:
> Unfortunately, I believe there are changes required.  So I have
> evaluated the question of whether there has been enough active
> participation in the last versions of the document and in the first
> part of this year to consider IDWG an active working group.  Based on
> my own conclusions and on the strong opinions of other area directors
> I've consulted with, IDWG no longer constitutes an active working
> group.  There is an insufficient core of active
> participants--particularly participants not involved in the
> document--to generate an informed consensus on changes.

Yes, that is certainly true of late. However, this document does have an
active user base of implementors, particularly in the academic and
research community. As such, it has gotten quite a bit of feedback and
fine-tuning.

> However it is desirable to publish IDMEF in at least some form.  The
> IESG said it would be willing to support publication of IDMEF as an
> experimental RFC provided that some consistency problems are fixed.
> The existing protocol document would be reclassified as an
> experimental RFC.
>=20
> So, what changes are required?
>=20
> The only critical change is that while the schema is normative, all
> the document is written in terms of the DTD not the schema.  As an
> example, IDMEF messages are required to include DTD declarations, and
> all of the class semantics are written in terms of the schema.

I do not believe that this is fully the case. The document has DTD
snippets to illustrate the model, but they can be easily replaced by
schema snippets. In fact, I have a version of the IDMEF draft that does
this immediately available for you.

> For this reason, I do not believe the schema can be normative.  Also,
> based on discussing this transition with others, I have very low
> confidence that the schema and DTD will be consistent. =20
>=20
> So I request that the schema be removed and the DTD become normative
> again.
>=20
> We can discuss alternatives, but you will need to convince me that the
> resulting document is self consistent and that you have the necessary
> resources to make that evaluation.

The reasons in favor of the schema, as I see them, are as follows:

- The move from DTD to schema was validated by the WG (when it was more
active) a long time ago.

- The schema introduces typing, which is a big facilitator in our case.
Documents that are valid within the DTD (considering all data as
strings) may not be valid with the schema.

- DTD and schema have been evolving side by side for a long time. They
validate the same example messages and others generated by several IDMEF
output software. As such I believe that they are equivalent.

This last reason is why -- altough i firmly believe that a schema is
better -- I am ready to comply with your requested change and send you
the final draft in this form. I do ask though that the schema be placed
as an appendix.

BTW, what kind of evaluation would convince you ? could you precise what
you have in mind ?

> If we have not made significant progress by the end of IETF 65 (end of
> March), then I will close the WG and mark the documents as dead.

Well, either way I will send you the updated IDMEF draft soon.

Best regards,

Herv=E9
--=20
Herv=E9 Debar             <mailto:[email protected]>
Tel: +33 (0)2 31 75 92 61            GSM: +33 (0)6 74 09 09 66
France T=E9l=E9com R&D              (new)Fax: +33 (0)2 31 37 83 43
42 rue des Coutures  (--)  BP 6243  (--)  F-14066 Caen Cedex 4