cti-taxii — archive

[Jason Keirstead]

If you feel like this is an unanswerable question, you might be stuck in the mental box of client/server architectures that I was stuck in for a while: you can’t push to a client – it’s dumb, and that’s not a supported pattern anyway! The subtle issue (for me anyway) was a conflation of the networking definition of client/server – the client connects, the server listens – and traditional client/server roles – the client is dumb, the server is smart. HTTP and web programming strongly reinforces this co-mingling of definitions – servers do the hard things and clients are just dumb, transient boxes that do what you tell them when they ask to be told something. For me, it was easy to work from an HTTP/Web Programming perspective for a while and lose sight of other perspectives. This used to be true in the "HTTP of old", but WebWorkers have changed all of this. HTTP/2 AKA SPDY combined with a Keep-Alive connection allows push actually. IE, client connects to server, the connection is semi-persistent , and resources get pushed down it that the client does not issue requests for. There is no reason TAXII 2.0 could not depend on HTTP/2.... - Jason Keirstead Product Architect, Security Intelligence, IBM Security Systems www.ibm.com/security www.securityintelligence.com Without data, all you are is just another person with an opinion - Unknown