Subject: UNSUBSCRIBE

From: "Bober, William" <[email-masked]>
Date: Thu, 1 Nov 2001 12:31:44 -0500

-----Original Message-----
From: Cynthia McLain
To: David A. Curry
Cc: [email-masked]
Sent: 11/1/2001 12:23 PM
Subject: Re: Comment's on Cynthia McLain's proposals

  David> Question: Do we need to include a clarification about Unix
"ctime" in this?
  David>   (The issue being that Unix "ctime" is commonly misinterpreted
as creation
  David>   time, when really it is last inode change time.  Unix does
not keep track
  David>   of file creation times.)  I know that's not an IDMEF issue,
but I keep
  David>   having this vision of lots of misinformed developers filling
that field
  David>   in on their Unix-based IDSes...

Since we are trying to define a generic file description,
I agree with your assessment that create_time should really
be the file creation time. However, disallowing the use of
create_time to present file information from Unix systems
will result in the loss of some, potentially valuable,
information.

What do you think of the idea of including a create_time
element in the Inode element to supply that information?
Despite the fact that the create_time is really the inode
modification time, the use of "create_time" instead of
"modify_time" would be more consistent with Unix terminology
in that context.

--Cindy

<html>
<body>
<font size="3" face="Times New Roman"><span style="mso-fareast-font-family: Times New Roman; mso-ansi-language: EN-US; mso-fareast-language: EN-US; mso-bidi-language: AR-SA">
- - - - - - - Appended by Scientific-Atlanta, Inc. - - - - - - -
<span style="font-size:10.0pt;font-family:Times New Roman;
mso-fareast-font-family:&quot;Times New Roman&quot;;mso-ansi-language:EN-US;mso-fareast-language:
EN-US;mso-bidi-language:AR-SA"></span><font face="Times New Roman" size="3"><span style="mso-fareast-font-family:Times New Roman; mso-ansi-language: EN-US; mso-fareast-language: EN-US; mso-bidi-language: AR-SA">This e-mail and any attachments may contain information which is confidential, proprietary, privileged or otherwise protected by law. The information is solely intended for the named addressee (or a person responsible for delivering it to the addressee). If you are not the intended recipient of this message, you are not authorized to read, print, retain, copy or disseminate this message or any part of it. If you have received this e-mail in error, please notify the sender immediately by return e-mail and delete it from your computer.</span></font></p>
</body>
</html>

---

From: Abdullah Alqahtani <[email-masked]>
Date: Thu, 1 Nov 2001 13:33:11 -0800 (PST)

---------------------------------
Do You Yahoo!?
Make a great connection at Yahoo! Personals.