[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]
Subject: RE: [cti-stix] STIX timestamps and ISO 8601:2000
TAXII 1.0/1.1 used RFC 3339 timestamps [1], which look like "1996-12-19T16:39:57-08:00". TAXII additionally specified a maximum number of milliseconds (e.g., "at most six places of precision"). If desired, this group could consider RFC 3339 timestamps with discussion about which time zone offsets are permitted (if any, or if everything is required to be in UTC), as well as whether a the milliseconds portion of the timestamp should have requirements beyond the RFC. Thank you. -Mark [1] https://www.ietf.org/rfc/rfc3339.txt -----Original Message----- From: cti-stix@lists.oasis-open.org [mailto:cti-stix@lists.oasis-open.org] On Behalf Of Trey Darley Sent: Monday, November 23, 2015 6:20 AM To: Barnum, Sean D. <sbarnum@mitre.org> Cc: Terry MacDonald <terry@soltra.com>; Wunder, John A. <jwunder@mitre.org>; cti-stix@lists.oasis-open.org Subject: Re: [cti-stix] STIX timestamps and ISO 8601:2000 On 23.11.2015 10:49:52, Trey Darley wrote: > > Naw, we don't need to add this as an issue to the tracker. We can > take a decision and just move on. > In life things are messy. Unlike the realm of pure mathematics, there are seldom *correct* answers but rather a spectrum of possibilities ranging from "good enough" to "just plain wrong". We are inevitably going to make mistakes that we will have to live with. No amount of deliberation is going to guarantee we arrive at a "perfect" solution but interminable debate *will* guarantee that we make little-to-no progress. It's like we're debating whether the "Description" field should be UTF8-encoded. We are no more likely to assemble a world-class congress of people with expert opinions on the merits of string encodings than we are to assemble a panel of experts on timestamp formats. But UTF8 is a "good enough" approach for string encodings and ISO 8601 is a "good enough" approach for timestamps. Let's not linger in indecision on such minutiae when we have bigger fish to fry. ^_^ Anyone with a good argument *against* ISO 8601+UTC+milliseconds speak up now. If there's no compelling argument against, then please let's move on. -- Cheers, Trey -- Trey Darley Senior Security Engineer 4DAA 0A88 34BC 27C9 FD2B A97E D3C6 5C74 0FB7 E430 Soltra | An FS-ISAC & DTCC Company www.soltra.com -- "It is always something." --RFC 1925
[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]