Hello,
Currently for references (STIGID, NIST, CUI, etc.) in our yaml content, we use a form of shortening the reference for STIGID and CCI e.g.
For CCI, we do something like the following:
``` disa: 2165,2696 ```
For STIGID, we do something like the following:
``` stigid: "020210" ```
This is was nice in the day that we only had just RHEL content, but now, we have Oracle, SuSE, Ubuntu, and the framework for macOS. Also, it would be nice to keep the build system agnostic of different reference identifiers formats for different platforms. Many users just copy/paste the references or use script changes in some way. Other repos use the full notation. As the STIGID and CCI are the only 2 references we short form, I am thinking that we should remove this short form notation and replace with the full notation to make it easier to script and copy/paste changes in addition to making it an easier experience for users coming from different repositories.
What do you think? Keep the same form? Use the full notation?
Thanks for your time,
Gabe
I wholeheartedly endorse using the full reference as shortening, for example, can make traceability checks harder.
+1
At first glance shortened values look a bit confusing with need to wrap in quotes single int like values to handle in scripts properly. For sure it can be identified and handled finally but having full reference would be consistent to me and more convenient for search and update.
Best regards, Ilya. On 3/26/2020 11:12 AM, Shawn Wells wrote:
On 3/26/20 1:21 PM, Rich Lucente wrote:
I wholeheartedly endorse using the full reference as shortening, for example, can make traceability checks harder.
+1
Was the right call back in the day. Project and content has evolved since. _______________________________________________ scap-security-guide mailing list -- scap-security-guide@lists.fedorahosted.org To unsubscribe send an email to scap-security-guide-leave@lists.fedorahosted.org Fedora Code of Conduct: https://urldefense.com/v3/__https://docs.fedoraproject.org/en-US/project/cod... List Guidelines: https://urldefense.com/v3/__https://fedoraproject.org/wiki/Mailing_list_guid... List Archives: https://urldefense.com/v3/__https://lists.fedorahosted.org/archives/list/sca...
On Thu, Mar 26, 2020 at 6:13 PM Gabe Alford redhatrises@gmail.com wrote:
Hello,
Currently for references (STIGID, NIST, CUI, etc.) in our yaml content, we use a form of shortening the reference for STIGID and CCI e.g.
For CCI, we do something like the following:
disa: 2165,2696
For STIGID, we do something like the following:
stigid: "020210"
Looks like a good call, would the long forms for the examples be CCI-2696 and RHEL-07-020210?
This is was nice in the day that we only had just RHEL content, but now, we have Oracle, SuSE, Ubuntu, and the framework for macOS. Also, it would be nice to keep the build system agnostic of different reference identifiers formats for different platforms. Many users just copy/paste the references or use script changes in some way. Other repos use the full notation. As the STIGID and CCI are the only 2 references we short form, I am thinking that we should remove this short form notation and replace with the full notation to make it easier to script and copy/paste changes in addition to making it an easier experience for users coming from different repositories.
What do you think? Keep the same form? Use the full notation?
Thanks for your time,
Gabe _______________________________________________ scap-security-guide mailing list -- scap-security-guide@lists.fedorahosted.org To unsubscribe send an email to scap-security-guide-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/scap-security-guide@lists.fedor...
Sorry, I am not 100% sure about what's meant by short vs long notation.
On Čt, bře 26, 2020 at 10:48, Gabe Alford redhatrises@gmail.com wrote:
... we use a form of shortening the reference for STIGID and CCI e.g.
For CCI, we do something like the following:
disa: 2165,2696
Is the shortening about product qualifiers? For example disa@rhel6: is the full reference, and disa: the shortened form? If this is the case, then I would like to point out that we can very easily enforce usage of the full form on selected references by tweaking the build system.
scap-security-guide@lists.fedorahosted.org