It may be long-term necessary to consider alternatives.
True in so very many ways. But I'd be more concerned that XCCDF is
likely to ossify irrevocably, given its current position with standards
bodies.
If it is now close to the time when a namespace (or two) for
scap-security-guide fragments, and a schema for those, can be
considered, I'd be willing to put up a trial balloon.
I'd be happy to look at it, but I have serious doubts that it's actually
a good idea. The ability to do some arbitrary things (which such
formalization is likely to forbid or inhibit) is very valuable, such as
macros for common phrases. Schemas are requirements levied upon content
developers.
I also want to keep the content language as simple as possible, and as
even Shawn's brief confusion indicated, XML namespaces don't exactly
make things more accessible.
Removing all namespaces from the (undefined) content creation language
was quite intentional. To the extent possible, I wanted to end up in a
place where the content creation language could be "monkey-see,
monkey-do." (Even though that clearly hasn't worked out, I'd at least
prefer that it not be endlessly verbose to higher primates).
This ultimately
becomes an exercise in avoiding arbitrary limitations of XCCDF by
allowing reasonable and useful expression ahead of (SP 800-126 rev 1)
XCCDF generation. As in variables that end up manifest in checks and
fixes. Ideally, the same meaning of value/variable (e.g., password
length) in all venues.
That is sane, and exactly what my little scripts actually are trying to
achieve (well, technically, undo for final output) in their "linking" phase.
I don't think XCCDF should be levied on content authors, rather,
something useful that can be competently turned into XCCDF should be
provided. Accompanied by a schema. It can be better than XCCDF; the
shortcomings of such a transformation can be noted so that the
proto-XCCDF/OVAL content can be dumbed-down as and if necessary.
Yes, as usual, yes. But I'd still prioritize vetting and creation of
(openly-available) content in the deficient (or undefined) languages
we've got now. It remains shocking to me how little high-quality SCAP
content there is, yet there seem to be thousands of people at these
conferences...