Another question came up in my mind - should there a optional "references" section in Selection schema to provide information such as Public POC was seen at a URL with optional "type" of reference information such as "exploit" - say something like
{"references" : [
{
"url": "https://www.exploit-db.com/exploits/32998",
"type": "exploit"
}
]}
Originally posted by @sei-vsarvepalli in #599 (comment)
I split this off into a separate issue because it seems like we should also consider whether the references apply to the list or to the individual decision point selections. I could imagine you'd want to say "we chose foo for Decision Point A because reference and bar for Decision Point B because other reference. We might need to understand better if/how this would be used to make a decision.
So I think the choices to be made include:
- Do decision point value selection lists need references?
- Are those references attached at the list level? At the decision point level? Both?
Originally posted by @sei-vsarvepalli in #599 (comment)
I split this off into a separate issue because it seems like we should also consider whether the references apply to the list or to the individual decision point selections. I could imagine you'd want to say "we chose foo for Decision Point A because reference and bar for Decision Point B because other reference. We might need to understand better if/how this would be used to make a decision.
So I think the choices to be made include: