Re: [cti-cybox] Patterning against multiple object types

[Greg Back <gback@mitre.org>]

On 7/12/2016 6:48 AM, Jason Keirstead wrote:
> My own feeling is that our grammar is already sufficiently complex such
> that I don't think we want to venture into such syntactic sugar right
> now - at least not if we expect people to have workable at-scale
> implementations in the next 12 months.

In term of complexity, would

    type = 'file-object' AND hashes.sha-256 = 		
    'aec070645fe53ee3b3763059376134f058cc337247c978add178b6ccdfb0019f'

be simpler than

    file-object:hashes.sha-256 =
    'aec070645fe53ee3b3763059376134f058cc337247c978add178b6ccdfb0019f'

? My gut says the former is easier to implement, but perhaps not as 
intuitive to a human reading (if that's a consideration we care about).

Greg