[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]
Subject: Re: [cti-users] Timestamp sub-second precision
My recollection is the argument was that timesec-frac adhered to RFC3339 ABNF 3.6. - Variable Repetition: *Rule >[time-secfrac = "." 1*DIGIT] Patrick Maroney Hi Pat
The clarity I want to get is why optional granularity were provided given that .1Z and .100Z were being considered equal(again assuming that we are all in agreement that they are equal?). The only importance would be if the consumer
of the Stix data needed to understand what the "actual" granularity the source system had. If we never lose granularity and we only facade granularity, such as the .1 becoming a .100, I am trying to understand what the scenario was for giving the optional
formats, and then having implementations have to keep the source granularity. It seems to be a huge overhead for implementation having to check and protect against added precision(added zeros) based on 4 possible combinations of sub second precision.
I don't want to start a debate about what level of precision should be used for each timestamp usage: I can perfectly agree that something like timestamp should have 1 format for all timestamp properties. (It's much easier to code.
And at the end of the day .0Z, .00Z and .000Z is basically the same imo. (In the GitHub issue would be great)
From: PAT MARONEY <patrick.maroney@mac.com>
Stephen et al,
Sent: Friday, April 12, 2019 6:25 PM To: Stephen Russett Cc: Jason Keirstead; cti-users@lists.oasis-open.org; Allan Thomson Subject: Re: [cti-users] Timestamp sub-second precision As one of the passionate advocates for temporality/causality representation the the STIX Language. I can address your question quickly and succinctly:
So while it makes absolutely ***NO SENSE*** to assign picosecond granularity to something like when a STIX Package or STIX Incident was created, it makes ***EVERY SENSE*** to express convey picosecond granularity to temporality/causality aspects
of system/networking events and relationships when sharing/conveying these events/patterns in a real-time eco-system
For the more esoteric aspects of the basis for assertion that sub-millisecond granularity is required one can go back to the three major "eruptions" of this temporal discourse since 2012. A simple experiment would be to take the inverse of a
10 Gigabit packet stream to get the required periodicity granularity.
Pat Maroney
PS - I actually can send you copies of the discourse if you are truly interested. Or just search the historical Nablle forum. Reach out to me directly and I'll send you the keywords.
On Apr 12, 2019, at 6:03 PM, Stephen Russett <stephen@digitalstate.ca> wrote:
Hey Jason, can you link to the specific thread that is the most relevant to the conversation ?
From: Jason Keirstead <jason.keirstead@ca.ibm.com>
Stephen et al, before we dive into this on GitHub can we ensure all involved have read through the TC email history on this issue.
Sent: Friday, April 12, 2019 6:01 PM To: Stephen Russett Cc: cti-users@lists.oasis-open.org; Allan Thomson Subject: Re: [cti-users] Timestamp sub-second precision All of these things were discussed at extreme, extreme length in the past. Many many months of discussion went into this timestamp format, it was one of the most debated single types in STIX 2. No one got exactly what they wanted, but concensus on something that was workable for all was reached eventually. I don't know why we're re-raising these things based on theoreticals that we have already covered many times before. Sent from IBM Verse Stephen Russett --- Re: [cti-users] Timestamp sub-second precision ---
Create a issue to continue the discussion:
From: Allan Thomson <athomson@lookingglasscyber.com> Reply: Allan Thomson <athomson@lookingglasscyber.com> Date: April 12, 2019 at 4:18:04 PM To: Stephen Russett <stephen@digitalstate.ca>, cti-users@lists.oasis-open.org <cti-users@lists.oasis-open.org> Subject: Re: [cti-users] Timestamp sub-second precision
|
[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]