Re: [cti] STIX Patterning - ALONG/OTHERWISE

Eric Burger wrote this message on Tue, Dec 13, 2016 at 09:52 -0500: > So if something does the same thing in the same way, we want to call it something else? > > I’m a bit slow here... I prefer the different operators as it makes it more obvious that [ipv4-addr:value = '192.0.2.5'] AND [ipv4-addr:value = '192.0.2.10'] and [ipv4-addr:value = '192.0.2.5' AND ipv4-addr:value = '192.0.2.10'] are different. And have VERY different meanings. > > On Dec 12, 2016, at 9:49 AM, Kirillov, Ivan A. <[email protected]> wrote: > > > > Right – it’s just the name of the operator. The semantics are the same. > > > > Regards, > > Ivan > > > > On 12/12/16, 6:46 AM, "Trey Darley" <[email protected] on behalf of [email protected]> wrote: > > > > On 12.12.2016 08:13:08, Eric Burger wrote: > >> I could be convinced. What is the distinction between: > >> > >> ([ipv4-addr:value = '192.0.2.5'] AND [ipv4-addr:value = '192.0.2.10']) > >> > >> and > >> > >> ([ipv4-addr:value = '192.0.2.5'] ALONGWITH [ipv4-addr:value = '192.0.2.10']) > >> > > > > Six characters. -- John-Mark