Re: [cti-stix] STIX timestamps and ISO 8601:2000

["Wunder, John A." <jwunder@mitre.org>]

Yep! Given the restrictions on RF3339 (it’s a more tightly defined format) my preference is to that. As a bonus, we’ll also be compatible with ISO 8601. Win-win.

So how about we alter your previous statement to:

"Anyone with a good argument *against* RFC3339+UTC+milliseconds speak
up now. If there's no compelling argument against, then please let's
move on.”

How would we encode decisions like this? I would probably have added an issue with a comment.

John

> On Nov 23, 2015, at 9:14 AM, Trey Darley <trey@soltra.com> wrote:
> 
> On 23.11.2015 13:27:00, Wunder, John A. wrote:
>> 
>> RFC3339 is a “profile" of ISO8601: all RFC3339 timestamps are
>> ISO8601 timestamps, but not all ISO8601 timestamps are RFC3339
>> timestamps.
>> 
>> See: http://stackoverflow.com/questions/522251/whats-the-difference-between-iso-8601-and-rfc-3339-date-formats
>> 
> 
> Precisely! John, you and I were obviously referencing the same sources. ^_^
> 
> -- 
> Cheers,
> Trey
> --
> Trey Darley
> Senior Security Engineer
> 4DAA 0A88 34BC 27C9 FD2B  A97E D3C6 5C74 0FB7 E430
> Soltra | An FS-ISAC & DTCC Company
> www.soltra.com
> --
> "No matter how hard you try, you can't make a baby in much less than 9
> months. Trying to speed this up *might* make it slower, but it won't
> make it happen any quicker." --RFC 1925