Re: [cti-stix] STIX timestamps and ISO 8601:2000

[Trey Darley <trey@soltra.com>]

On 23.11.2015 14:40:17, Wunder, John A. wrote:
> Yep! Given the restrictions on RF3339 (it’s a more tightly defined
> format) my preference is to that. As a bonus, we’ll also be
> compatible with ISO 8601. Win-win.
> 
> So how about we alter your previous statement to:
> 
> "Anyone with a good argument *against* RFC3339+UTC+milliseconds
> speak up now. If there's no compelling argument against, then please
> let's move on.”
> 

I'm totally good with that, John! ^_^

> 
> How would we encode decisions like this? I would probably have added
> an issue with a comment.
> 

We clearly need a more agile way of nailing down these sort of
decisions. The MTI serialization issue is significant enough to
justify putting it to a formal CTI-wide vote. While the question of
timestamp format *also* cuts across all three CTI standards, putting
it to a formal vote seems like overkill.

If we had something like the oft-proposed StackOverflow instance, we
could post the draft timestamp decision there, open a 7-14 day period
in which folks could up/down-vote, comment, etc. Assuming that there
was a clear consensus at the end of the (shall we say) comment period,
then we consider the issue closed for all intents and purposes.

Not sure how we could possibly adapt the Github issue tracker to
support that sort of community feedback mechanism...but we need
*something* better.

-- 
Cheers,
Trey
--
Trey Darley
Senior Security Engineer
4DAA 0A88 34BC 27C9 FD2B  A97E D3C6 5C74 0FB7 E430
Soltra | An FS-ISAC & DTCC Company
www.soltra.com
--
"It is more complicated than you think." --RFC 1925

Attachment: signature.asc
Description: PGP signature