Corrections proposed for IDMEF draft #7 (6/20/2002)

Hi Dave,

Changes were made to the UserId and Service XML
definitions between the December 2001 and June 2002
versions of the IDMEF internet draft (ie., versions
06 and 07). As I understand it, there was an issue
of 0-look-ahead non-determinism with the original
XML of the form: (a | b | (a,b)). The solution was
to use XML of the form (a?, b?) instead. Unfortunately,
the new definition does not require the presence of
a value whereas the previous definition did have
such a requirement.

I'd like to propose using the construct ((a,b?) | (b,a?)).
I believe this construct meets both the XML requirements
for determinism as well as the IDMEF goal of encouraging
interoperability.

If you (and others) agree, ((name, number?) | (number, name?))
would be used for UserId instead of (name?, number?)
and and ((name, port?) | (port, name?)) would be
used for Service instead of (name?, port?).

Thanks,
--Cindy