OASIS Mailing List ArchivesView the OASIS mailing list archive below
or browse/search using MarkMail.

 


Help: OASIS Mailing Lists Help | MarkMail Help

cti-stix message

[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]


Subject: RE: [cti-stix] STIX timestamps and ISO 8601:2000


TAXII 1.0/1.1 used RFC 3339 timestamps [1], which look like "1996-12-19T16:39:57-08:00". TAXII additionally specified a maximum number of milliseconds (e.g., "at most six places of precision"). 

If desired, this group could consider RFC 3339 timestamps with discussion about which time zone offsets are permitted (if any, or if everything is required to be in UTC), as well as whether a the milliseconds portion of the timestamp should have requirements beyond the RFC.

Thank you.
-Mark

[1] https://www.ietf.org/rfc/rfc3339.txt

-----Original Message-----
From: cti-stix@lists.oasis-open.org [mailto:cti-stix@lists.oasis-open.org] On Behalf Of Trey Darley
Sent: Monday, November 23, 2015 6:20 AM
To: Barnum, Sean D. <sbarnum@mitre.org>
Cc: Terry MacDonald <terry@soltra.com>; Wunder, John A. <jwunder@mitre.org>; cti-stix@lists.oasis-open.org
Subject: Re: [cti-stix] STIX timestamps and ISO 8601:2000

On 23.11.2015 10:49:52, Trey Darley wrote:
> 
> Naw, we don't need to add this as an issue to the tracker. We can
> take a decision and just move on.
> 

In life things are messy. Unlike the realm of pure mathematics, there
are seldom *correct* answers but rather a spectrum of possibilities
ranging from "good enough" to "just plain wrong". We are inevitably
going to make mistakes that we will have to live with. No amount of
deliberation is going to guarantee we arrive at a "perfect" solution
but interminable debate *will* guarantee that we make little-to-no
progress.

It's like we're debating whether the "Description" field should be
UTF8-encoded. We are no more likely to assemble a world-class congress
of people with expert opinions on the merits of string encodings than
we are to assemble a panel of experts on timestamp formats. But UTF8
is a "good enough" approach for string encodings and ISO 8601 is a
"good enough" approach for timestamps. Let's not linger in indecision
on such minutiae when we have bigger fish to fry. ^_^

Anyone with a good argument *against* ISO 8601+UTC+milliseconds speak
up now. If there's no compelling argument against, then please let's
move on.

-- 
Cheers,
Trey
--
Trey Darley
Senior Security Engineer
4DAA 0A88 34BC 27C9 FD2B  A97E D3C6 5C74 0FB7 E430
Soltra | An FS-ISAC & DTCC Company
www.soltra.com
--
"It is always something." --RFC 1925


[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]