Ballot for conflict-review-grimminck-safe-ioc-sharing
Yes
No Objection
No Record
Summary: Has enough positions to pass.
Ballot question: "Is this the correct conflict review response?"
I agree with the conflict review proposed by Andy. Thanks to Stefan for the effort put into documenting this transformation procedure. This is useful work. Please find below some minor comments; feel free to ignore or grab whatever useful: # Consider adding an informative reference to RFC9424 (produced by the concluded OPSEC WG) for a background on IoCs, especially Section 3.1 on IoC types. # safe CURRENT: It describes a safe obfuscation format that reduces the risk of accidental execution or activation when IOCs are displayed or transmitted. “safe” would imply that the risk is nullified, not only “reduce”d. Maybe reword to better reflect the provided benefit. # Some parts of the text reasons about "address" while these are actually prefixes. # In addition to the IPv4-mapped flavor, maybe consider also listing the case of 64:ff9b::/96 (maybe as part of the test vectors) RFC6052: IPv4-embedded IPv6 addresses constructed using the Well-Known Prefix or a /96 Network- Specific Prefix may be represented using the alternative form presented in Section 2.2 of [RFC4291], with the embedded IPv4 address represented in dotted decimal notation. Cheers, Med
Even a lot of IPv6 content :-)