Re: Corrections proposed for IDMEF draft #7 (6/20/2002)

Just small observation in support of Cynthia's proposal to change
initial definition (a | b | (a,b)) that create problems when you try to
define schema as we are doing currently in IODEF.

We will look at this approach in description options/choices for similar
elements in IODEF as well.

Yuri

Cynthia McLain wrote:
> 
> Hi Dave,
> 
> Changes were made to the UserId and Service XML
> definitions between the December 2001 and June 2002
> versions of the IDMEF internet draft (ie., versions
> 06 and 07). As I understand it, there was an issue
> of 0-look-ahead non-determinism with the original
> XML of the form: (a | b | (a,b)). The solution was
> to use XML of the form (a?, b?) instead. Unfortunately,
> the new definition does not require the presence of
> a value whereas the previous definition did have
> such a requirement.
> 
> I'd like to propose using the construct ((a,b?) | (b,a?)).
> I believe this construct meets both the XML requirements
> for determinism as well as the IDMEF goal of encouraging
> interoperability.
> 
> If you (and others) agree, ((name, number?) | (number, name?))
> would be used for UserId instead of (name?, number?)
> and and ((name, port?) | (port, name?)) would be
> used for Service instead of (name?, port?).
> 
> Thanks,
> --Cindy