Re: [cti] Patterning Feedback -Timescales/Periodicity

["Bret Jordan (CS)" <Bret_Jordan@symantec.com>]

John-Mark,

The decision to go to JSON was not so that it would be human readable.  It was to make it more friendly and familiar to developers and product managers that already process JSON based APIs today.  The other reason I pushed for this for 18 months was to get rid of the horrid XML based implementation, overly complex nested structures, namespaces, and xsi-type extensions we had in STIX1.1.

My primary goal was not optimizations over the wire.  It was purely about ease of adoption for products and vendors.  

Bret

---

From: cti@lists.oasis-open.org <cti@lists.oasis-open.org> on behalf of John-Mark Gurney <jmg@newcontext.com>
Sent: Wednesday, October 26, 2016 1:31:48 PM
To: Eric Burger
Cc: cti@lists.oasis-open.org
Subject: Re: [cti] Patterning Feedback -Timescales/Periodicity

 

Eric Burger wrote this message on Wed, Oct 26, 2016 at 12:47 -0400:
> Upon reflection, I have convinced myself the only unit should be seconds, with no specified precision.
>
> Yes, the examples given are nice and SQL-like and human readable.
>
> I would offer that examples with those nice, human readable decadal time units are thoroughly unrelated and of near zero value towards a MVP. Why? Because that nice, human readable format, either as specifying patterns or for displaying what was detect, is a role of the user interface software. It is not a role of the data format.

Don't bring human readable into this, as the TC decided to use JSON,
which was particullarly choosen to be human readable, even though other
serialization formats would have been better (more machine readable,
more compact, etc).

If people care about performance of pattern matching, they will parse
it to an AST at import time, and only keep the AST (or other optimized
representation of the pattern, maybe finite state machine, etc), and
not reparse the pattern each import.

--
John-Mark

---------------------------------------------------------------------
To unsubscribe from this mail list, you must leave the OASIS TC that
generates this mail.  Follow this link to all your TCs in OASIS at:
https://www.oasis-open.org/apps/org/workgroup/portal/my_workgroups.php