Re: Problem reporting PIDs with IDMEF

Just to be difficult, I will point out that when we all learned what an
"integer" was in elementary school, we didn't learn anything about 32
bits.  Integers are the set of positive whole numbers, negative whole
numbers, and zero.  When the IDMEF specification says "integer," that's
what it means.  :-)

I will agree with Laura, though, that the specification is not clear on
what developers should do.  However, I'm very hesitant to go through and
say "32 bits" or "16 bits" or whatever -- we're bound to get something
wrong and cause more problems (e.g., what if we had said "16 bits" for
PID?).

I would instead be inclined to specifically state that we are not going
to specify a min/max value for these types, and that implementors should
be prepared to deal with this -- use the largest "reasonable" data types
they can, and have some way to handle values that cannot fit in those
types without failing.

Thoughts?

On a separate note, I'm still curious about Laura's more-than-32-bit PIDs.
Win2k is a 32-bit o/s, right?  So unless they're using 64-bit data types
for PIDs (which seems unlikely), PIDs should fit in 32 bits.  Laura, are
you sure the data you're getting (or the things reporting the data) aren't
broken?  (Of course, even if they are broken, you may not be able to do
anything about it.)

--Dave