OASIS Mailing List ArchivesView the OASIS mailing list archive below
or browse/search using MarkMail.


Help: OASIS Mailing Lists Help | MarkMail Help

cti-stix message

[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]

Subject: RE: [cti-stix] STIX timestamps and ISO 8601:2000

The one part of this I want to make sure people do not gloss over:

Do not make the mistake of confusing library support for reduced computational overhead. Regardless of if there is robust parsing support for a format in Java or Python or Ruby or whichever, said "parsing magic" can make the life of the programmer easier, but it does not reduce the overhead of that parsing. If the field can have N multiple different ISO 8601 compliant formats inside it then this potentially increases the computational burden by N for every new parsing attempt. Timestamp is going to be one of the most critical pieces of information for software to *always* parse from text into a number, so if we are not using EPOCH then the overhead should be as low as possible - This is why I am strongly pushing for a single format in one field and not "ISO 8601 with X or Y"

Jason Keirstead
Product Architect, Security Intelligence, IBM Security Systems
www.ibm.com/security | www.securityintelligence.com

Without data, all you are is just another person with an opinion - Unknown

Inactive hide details for "Struse, Richard" ---11/24/2015 09:41:06 PM---Good points John!"Struse, Richard" ---11/24/2015 09:41:06 PM---Good points John!

From: "Struse, Richard" <Richard.Struse@HQ.DHS.GOV>
To: "Wunder, John A." <jwunder@mitre.org>, "cti-stix@lists.oasis-open.org" <cti-stix@lists.oasis-open.org>
Date: 11/24/2015 09:41 PM
Subject: RE: [cti-stix] STIX timestamps and ISO 8601:2000
Sent by: <cti-stix@lists.oasis-open.org>

Good points John!

So, since there appears to be robust library support for manipulating ISO8601-formatted date/time values and since it allows the representation of reduced-precision values (such as a date + hour or date + hour + minute), is there any reason why we can’t agree on this and move on?

From: cti-stix@lists.oasis-open.org [mailto:cti-stix@lists.oasis-open.org] On Behalf Of Wunder, John A.
Tuesday, November 24, 2015 6:55 PM
Re: [cti-stix] STIX timestamps and ISO 8601:2000


After thinking about this for a bit and seeing all of the back and forth (in particular Alex’s e-mail below), it occurs to me that maybe the right answer is just to use ISO8601 as-is. It’s a standard for a reason after all

Here are the advantages:

- ISO 8601 is an international standard. There are libraries in many languages that are able to parse it [1,2,3,4,5]. As Alex says, we’ll have better luck getting tools to adopt an RFC or ISO standard vs. getting them to use something we invent.
- ISO 8601 supports arbitrary precision. Most libraries will zero-out the precision, which is perfect for simple consumers: that’s exactly what we’ve discussed. If on the other hand your application cares about precision you may be able to find a library to do it (the advantage of an international standard) or you may have to do it yourself. But this is fine: simple things are simple, complicated things are more complicated.
- I tend to agree with Alex on timezones. As long as the timezone is specified it shouldn’t matter what we use. Let’s again just go with the existing standard and allow offsets or UTC (so long as some kind of timezone is specified).
- ISO 8601 also supports things like duration…for our purposes, we would want to limit it to actual timestamps.

To summarize: handling dates and times in programming is hard [6] and we could spend weeks trying to find the perfect solution. Let’s focus on cyber threat intelligence though and use the existing international standard for dates and times.

Also, in all of my decisions I think: is there an XKCD comic about this? Yes, there is: https://xkcd.com/1179/


[1]: http://joda-time.sourceforge.net/apidocs/org/joda/time/format/ISODateTimeFormat.html
[2]: http://stackoverflow.com/questions/127803/how-to-parse-an-iso-8601-formatted-date-in-python
[3]: https://github.com/arnau/ISO8601 (plus somewhat more limited support in standard libs)
[4]: http://stackoverflow.com/questions/1536633/parsing-iso-8601-string-to-datetime-in-net
[5]: https://developer.mozilla.org/en-US/docs/Web/_javascript_/Reference/Global_Objects/Date/parse
[6]: http://infiniteundo.com/post/25326999628/falsehoods-programmers-believe-about-time

[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]