Re: [cti-stix] STIX timestamps and ISO 8601:2000

["Wunder, John A." <jwunder@mitre.org>]

I would recommend RFC3339 over ISO8601.

RFC3339 is a “profile" of ISO8601: all RFC3339 timestamps are ISO8601 timestamps, but not all ISO8601 timestamps are RFC3339 timestamps.

See: http://stackoverflow.com/questions/522251/whats-the-difference-between-iso-8601-and-rfc-3339-date-formats

John

> On Nov 23, 2015, at 7:40 AM, Davidson II, Mark S <mdavidson@mitre.org> wrote:
> 
> TAXII 1.0/1.1 used RFC 3339 timestamps [1], which look like "1996-12-19T16:39:57-08:00". TAXII additionally specified a maximum number of milliseconds (e.g., "at most six places of precision"). 
> 
> If desired, this group could consider RFC 3339 timestamps with discussion about which time zone offsets are permitted (if any, or if everything is required to be in UTC), as well as whether a the milliseconds portion of the timestamp should have requirements beyond the RFC.
> 
> Thank you.
> -Mark
> 
> [1] https://www.ietf.org/rfc/rfc3339.txt
> 
> -----Original Message-----
> From: cti-stix@lists.oasis-open.org [mailto:cti-stix@lists.oasis-open.org] On Behalf Of Trey Darley
> Sent: Monday, November 23, 2015 6:20 AM
> To: Barnum, Sean D. <sbarnum@mitre.org>
> Cc: Terry MacDonald <terry@soltra.com>; Wunder, John A. <jwunder@mitre.org>; cti-stix@lists.oasis-open.org
> Subject: Re: [cti-stix] STIX timestamps and ISO 8601:2000
> 
> On 23.11.2015 10:49:52, Trey Darley wrote:
>> 
>> Naw, we don't need to add this as an issue to the tracker. We can
>> take a decision and just move on.
>> 
> 
> In life things are messy. Unlike the realm of pure mathematics, there
> are seldom *correct* answers but rather a spectrum of possibilities
> ranging from "good enough" to "just plain wrong". We are inevitably
> going to make mistakes that we will have to live with. No amount of
> deliberation is going to guarantee we arrive at a "perfect" solution
> but interminable debate *will* guarantee that we make little-to-no
> progress.
> 
> It's like we're debating whether the "Description" field should be
> UTF8-encoded. We are no more likely to assemble a world-class congress
> of people with expert opinions on the merits of string encodings than
> we are to assemble a panel of experts on timestamp formats. But UTF8
> is a "good enough" approach for string encodings and ISO 8601 is a
> "good enough" approach for timestamps. Let's not linger in indecision
> on such minutiae when we have bigger fish to fry. ^_^
> 
> Anyone with a good argument *against* ISO 8601+UTC+milliseconds speak
> up now. If there's no compelling argument against, then please let's
> move on.
> 
> -- 
> Cheers,
> Trey
> --
> Trey Darley
> Senior Security Engineer
> 4DAA 0A88 34BC 27C9 FD2B  A97E D3C6 5C74 0FB7 E430
> Soltra | An FS-ISAC & DTCC Company
> www.soltra.com
> --
> "It is always something." --RFC 1925