[2.1] clarification on object creator text: section 3.5

[StephenOTT]

It states that the object creator is the entity that generates the ID (the stix identifier?) and that the created by ref should hold the object creator info. If someone else creates a new modified version of this object, it states that they must create a new Id. Does this effectively mean that the object creator is the "owner" of that id and no one else can version a object using the same ID? The last of the text then says "they are considered object creator of the new object for the purposes of versioning"

It would seem that id in this section does not mean identifier. But was meant to mean version (identifier + modified)

[rpiazza]

The identifier + modified date uniquely identify a version of a STIX object.

The last sentence is just emphasizing that when you decide to create a new object based on another object for which you are not the owner - you as the owner of the new object can make changes to that new object by creating new versions.

[StephenOTT]

To further clarify: given that the derived-from relationship says that it should not be used as a substitute for the versioning process (3.7), this all reads like we are saying that is a non material change (as per direction from 3.6.2) was being made by someone who is not the object creator, then they cannot version, they must create a new object with new Id.

I am not saying that is wrong: I am outlining that 3.5, 3.6, 3.6.2 and 3.7 are unclear in their structure / flow to the read to understand when a new id is created, and if it is created how you link them together (presumably from the derived from rel)

[StephenOTT]

@rpiazza that description I believe further confuses the topic.

[rpiazza]

Section 3.6.2 is only for the object creator. ALL others MUST create a new object if they wish to make any change (material or otherwise) to an existing object they don't own. BTW, creating a derived_from relationship object between the original and new object is a SHOULD.

I do admit that one of the examples in that section (Example of consumer workflow), about a consumer, not the object creator. It might be better elsewhere in 3.6.

[StephenOTT]

I would recommend that the SHOULD text for the derived from you mention be added into the 3.7 or at least reference it.

Generally it starts to get confusing because of the very closely related terms that are all almost overloaded

• Identifier is id
• Version is identified uniquely with id and modified
• New version is just update of modified, which effectively creates a new uniquely identified versioned object.
• New object
• New object with a additional derived rel
• And the 3.5 section that says how the created by ref SHOULD be used but it is unclear if that was meant to be "all objects SHOULD have their created by ref populated / not be null"

This all effectively boils down to "the creator owns the Id and only the creator can make version-changes to objects with that Id".

[jordan2175]

If you have specific suggestions please add them to the issue.

[jordan2175]

The modified timestamp is the version of the object. A version is NOT the ID+modified. You may do that in your datastore or in your code if you so choose. The difference in terms between identifier and ID is ID is a property name and identifier is a type. We tried to use the red color to help distinguish when we are talking about a "type" versus and instance of the "type".