All timestamps should follow the exact same mandatory format. Having optional different representations of things, is why STIX is so complicated and we have agreed to move away from that direction. Surely, for something as simple as a timestamp, we can make some progress here and all agree on one mandatory format....
If nanoseconds is optional, then you are creating a large parsing load (instead of parsing a million timestmap fields 1 way, I need to attempt it 2/3/4... n ways) for clients for no good reason. It would be vastly preferred if everyone include nanoseconds and simply zero them out if they can't produce them or they're not relevant.
On the other hand, if people think this is silly because hardly anyone can produce nanoseconds, then we should drop nanoseconds and only include milliseconds in the mandatory format until such a time. Whatever is chosen it should be *mandatory* not an option. The fact that timestamps sometimes include MS and sometimes do not is a large reason I kicked this thread off in the first place.
-
Jason Keirstead
Product Architect, Security Intelligence, IBM Security Systems
www.ibm.com/security | www.securityintelligence.com
Without data, all you are is just another person with an opinion - Unknown
Tony Rutkowski ---11/23/2015 11:42:05 AM---You want UTC, not GMT (unless you're just implementing it in the UK).From: Tony Rutkowski <tony@yaanatech.com>
To: Jason Keirstead/CanEast/IBM@IBMCA, Trey Darley <trey@soltra.com>
Cc: "Barnum, Sean D." <sbarnum@mitre.org>, Patrick Maroney <Pmaroney@Specere.org>, Jerome Athias <athiasjerome@gmail.com>, "cti-stix@lists.oasis-open.org" <cti-stix@lists.oasis-open.org>, "Wunder, John A." <jwunder@mitre.org>
Date: 11/23/2015 11:42 AM
Subject: Re: [cti-stix] STIX timestamps and ISO 8601:2000