I apologize if this is a little off-topic for this list, but a question: what are others who use STIG Viewer planning to do once Oracle JDK 8 / JavaFX go EOL in January 2019? Any Oracle Java 8 security updates released after January 2019 will require a commercial support license from Oracle: https://developers.redhat.com/blog/2018/11/05/migrating-from-oracle-jdk-to-openjdk-on-red-hat-enterprise-linux-what-you-need-to-know/ STIG Viewer requires Oracle JDK 8 and JavaFX 8 in order to function. Oracle JDK 11 is the next LTS (long term support) version of Java. (Java 9 and Java 10 are not LTS releases, and are already EOL.) But in Java 11, Oracle removed JavaFX: https://www.infoworld.com/article/3305073/java/removed-from-jdk-11-javafx-11-arrives-as-a-standalone-module.html The OpenJFX project provides a JavaFX 11 implementation that works with OpenJDK 11: https://openjfx.io/ But: I tested the latest STIG Viewer (version 2.8) with OpenJDK 11 / OpenJFX 11, and it does not work; it simply crashes at startup. This will shortly place all STIG Viewer users in the situation where they must purchase a commercial support contract from Oracle in order to run STIG Viewer, because STIG Viewer requires outdated / EOL technology. I asked DISA/IASE what their intentions were with STIG Viewer in light of this. As of 2018-11-27, this was their response:There are currently no plans on creating a non-Oracle java version of STIG Viewer at this time. We also have no information regarding how DoD will be addressing the licensing requirement for Oracle java going forward.So. Ideally, I'd like to find a Linux replacement for STIG Viewer—something that can read, annotate, and write STIG Viewer checklist (*.ckl) files. But although SCAP Workbench can load and check STIGs, unless I'm missing something, it has no support for STIG Viewer checklist files.
Wonder if this is something that could be incorporated into Security Central?I can't be the only person in this boat. What are others doing?