full-disclosure - OT: date formats

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <200208082245.SAA04229@linus.mitre.org>
From: coley at linus.mitre.org (Steven M. Christey)
Subject: OT: date formats

Brian Hatch said:

>> You're thinking Europeans date format. Here in the US, we usually use
>> MM/DD/YY, so he's probably out more like 4 days.
>
>Here in the US, those who prefer nasty ambiguity problems
>use MM/DD/YY format.

Because of these differences, security advisories that use these date
formats have the unfortunate effect of being difficult or impossible
to resolve more than a few months after they were initially published.
This matters if you care about historical or trend analysis.  If you
like vendor status timelines, the European/US format can mean the
difference between whether a vendor took a day to respond, or 2
months.

>Those of us who prefer to have easily identifiable dates use
>YYYY/MM/DD, which also has the side benefit of sorting correctly in
>ASCII.

Having done a little thinking on the use of dates, it seems that only
the MM/DD/YY* or DD/MM/YY* formats have these issues.  "20-Sep-02,"
"February 9, 2002," "2002-04-05," "2002-10-12," etc. don't seem to be
ambiguous (YYYY-DD-MM doesn't seem to be used.)

- Steve