Re: Problem reporting PIDs with IDMEF

>>>>> On Mon, 22 Jul 2002, Laura S. Tinnel, identified as "Laura" below, wrote:

  Laura> Couple of questions. 1. Is there a particular reason that type
  Laura> "integer" was chosen? It would seem that "unsigned" would be better
  Laura> since operating systems tend to use positive numbers for PIDs. 2. The
  Laura> actual size of an integer is platform dependent. This is problematic
  Laura> in a networked heterogeneous environment. How do you propose handling
  Laura> situations where an integer value is valid on one host and sent to
  Laura> another where it is too large a value and considered invalid?

1. Remember, XML doesn't actually have types.  The only reason we identified
   types for things at all was just to make it clear, for example, that we
   expect an integer-ype datum here, as opposed to say, a string.

   In hindsight, your point about unsigned is a good one, although since we
   do not specify minimum or maximum values for those sorts of data, I'm not
   sure it would ultimately make any difference (you can always find a size
   it won't fit in).

2. "Be conservative in what you send, and liberal in what you accept."  :-)

You could certainly use an unsigned, if you wanted to.  Or, put it out in
hexadecimal and don't worry about the sign.

I will point out that "0.3" is a pretty old version of IDMEF.  You might want
to think about getting a newer one, depending on how far along you are.

--Dave