search

opencybersecurityalliance / PACE

Posture Attribute Collection and Evaluation
Other
23 stars 4 forks source link

Should pace "pick a winner" for PAR database? #43

Closed sparrell closed 2 years ago

sparrell commented 2 years ago

Should PACE standardize on the database for the PAR or just standardize on the PACE interfaces?

Note this is an independent issue from whether there should be one or more than one reference implementation. For example PACE could decide to allow relational, labeled property graph, or RDF graph databases as long as they met a interface we define; and yet could still decide to have only one reference implementation (eg a Neo4j labeled property graph). Conversely it could decide to standardize on one database (eg a particular Neo4j labeled property graph schema) and still have two different open source PACE repos with different implementations of that database as long as it met the interface standards.

This issue is to decide whether to choose one database (and if so, which one); or to decide to only specify the interfaces.

Possibilities include (and could quibble over which belong in which category):

This issue is related to issues #42 and #44

sparrell commented 2 years ago

My opinion we should NOT pick a winner. I recommend we specify the interfaces, not implementations. I'd go so far as to recommend we have several reference implementations of different types.

slarchacki22 commented 2 years ago

03/28/2022 - did revisit this issue as we ran out of time previously. Consensus is to not pick a winner. Specifying interfaces may weigh in on the implementation.

adammontville commented 2 years ago

Is this now resolved?

slarchacki22 commented 2 years ago

Added to FAQ at the 4/25/2022 PACE meeting