Re: [cti-stix] STIX timestamps and ISO 8601:2000

["Wunder, John A." <jwunder@mitre.org>]

I don’t really see a reason to not use the issue tracker for this. Post it to the issue tracker w/ a reasonable description and then wait to see if anybody comments. If nobody comments, tag it as “discussed”. When it gets added to the spec, it gets closed.

John

> On Nov 23, 2015, at 3:06 PM, Barnum, Sean D. <sbarnum@mitre.org> wrote:
> 
> I am not against quick (though complete) discussion and decisions being made but they MUST be tied to an issue with appropriate comments as John suggests here.
> 
> sean
> 
> 
> 
> 
> On 11/23/15, 9:40 AM, "cti-stix@lists.oasis-open.org on behalf of Wunder, John A." <cti-stix@lists.oasis-open.org on behalf of jwunder@mitre.org> wrote:
> 
>> Yep! Given the restrictions on RF3339 (it’s a more tightly defined format) my preference is to that. As a bonus, we’ll also be compatible with ISO 8601. Win-win.
>> 
>> So how about we alter your previous statement to:
>> 
>> "Anyone with a good argument *against* RFC3339+UTC+milliseconds speak
>> up now. If there's no compelling argument against, then please let's
>> move on.”
>> 
>> How would we encode decisions like this? I would probably have added an issue with a comment.
>> 
>> John
>> 
>>> On Nov 23, 2015, at 9:14 AM, Trey Darley <trey@soltra.com> wrote:
>>> 
>>> On 23.11.2015 13:27:00, Wunder, John A. wrote:
>>>> 
>>>> RFC3339 is a “profile" of ISO8601: all RFC3339 timestamps are
>>>> ISO8601 timestamps, but not all ISO8601 timestamps are RFC3339
>>>> timestamps.
>>>> 
>>>> See: http://stackoverflow.com/questions/522251/whats-the-difference-between-iso-8601-and-rfc-3339-date-formats
>>>> 
>>> 
>>> Precisely! John, you and I were obviously referencing the same sources. ^_^
>>> 
>>> -- 
>>> Cheers,
>>> Trey
>>> --
>>> Trey Darley
>>> Senior Security Engineer
>>> 4DAA 0A88 34BC 27C9 FD2B  A97E D3C6 5C74 0FB7 E430
>>> Soltra | An FS-ISAC & DTCC Company
>>> www.soltra.com
>>> --
>>> "No matter how hard you try, you can't make a baby in much less than 9
>>> months. Trying to speed this up *might* make it slower, but it won't
>>> make it happen any quicker." --RFC 1925
>>