text: CPE - Common Platform Enumeration - Official CPE Dictionary - metadata changes; status
  Official CPE Dictionary - metadata changes; status
  NIST is planning to change how the 'status' attribute contained within the NIST metadata extension of the CPE Dictionary is populated. At the current time names contained within the Official CPE Dictionary have a status value of either 'DRAFT' or 'FINAL'. NIST will change the status of all names contained in the Official CPE Dictionary to a status of 'FINAL'. This message serves as an advance notice of this change and provides an opportunity to the CPE community to answer the question:
  Will employing this status change adversely affect consumers of the CPE Dictionary?
  Another notice will be issued with a specific date for when the change will take effect after the community has had an opportunity to voice any concerns. Please provide feedback on this list or directly to NIST at [hidden email] by Friday, September 16, 2011.
  Re: Official CPE Dictionary - metadata changes; status
  I'd be interested in hearing from the vendor community regarding potential impacts of this change on existing implementations. That said, the proposal begs the question, what information is the "status" metadata field intended to convey, and how is that information intended to be used?
  Here's an argument for maintaining a meaningful distinction between "candidate" (draft) and "approved" (final) names. Suppose we were to establish a mechanism (e.g., a web service) whereby authorized agents could directly submit new names to the Official Dictionary. (Imagine we federated authority for name generation to approved entities, such as software publishers and trusted third parties.) The web service would perform minimal syntactic and semantic validation of names, then enter them immediately into the Official Dictionary with a status of DRAFT. This would alert authorities within NIST to (eventually) review those names, but in the interim they would be considered valid and usable. The DRAFT status would serve as a flag to dictionary consumers, that any name marked as DRAFT could, at a moment's notice, change to FINAL (when approved) or instead be deprecated and replaced with a vetted and FINAL name.
  Such an approach could serve not only to give the "status" field real meaning, remove possible bottlenecks to dictionary growth, and start building on the foundation (laid in the CPE 2.3 Dictionary specification) for so-called "extended" CPE dictionaries.