I have summarized existing proposals, and I have replied to some of them:
On 30. 07. 20 1:02, Gabe Alford wrote:
- Rename description, rationale to html_description, html_rationale.
Reason: We could start to introduce Markdown input, and doing it this
way would allow us to do it gradually. We probably want to have
a canonical form, but we could offer more possibilities for
I don't think changing keys like this makes sense or adds value, and
in fact, will make things more confusing.
Just supporting markdown in the text would better and easier for
people to understand.
Jan also isn't in favor of changing keys. I think that we can shift to
markdown without changing keys only if we convert existing HTML markup
to md at the same time. And I think that this can be feasible.
There are the following problems with preserving key names and
introducing new input type:
1. Autodetection of HTML vs MD isn't trivial: Markdown can contain HTML
tags - consider e.g. XCCDF value substitutions in an otherwise
markdown rule description.
2. Blank lines have some significance in markdown, but not at all in
HTML, so if we start processing existing tag-less text as markdown,
the text layout may change significantly.
Technically, processing text as markdown is extremely easy to implement,
it would just require to add a new project dependency.
- Restructure project's folder structure - right now, the
products is really long, which makes the project page too long.
products in a separate directory would also allow us to get a list of
supported products programmatically from the filesystem.
I really don't want to do this again. Not in favor, and there is
nothing preventing getting the list programmatically right now.
FTR, Jan is not in favor of this either. But when we ask ourselves a
question why could it be that a project is perceived as complex, isn't
this one of the first oddities one comes across? That linux_os is a
container of rules, but rhel7 is a product? That ssg is not a product,
but a Python package? Neither cmake is a product, but support for the
build system, along with build-scripts? That applications/openshift is a
container of rules much like linux_os, just being located elsewhere? And
did you know that we now have an ocp-resources folder in the root directory?
I think that a folder structure would make things more approachable, and
that moving just products wouldn't cause a big pain - the only thing
that is likely to be used by others is one or two profile files in the
product they are interested in.
- Put macros where they belong. We have plenty of boilerplate in
project, and macros can keep the code readable and free of
Moreover, if people use a macro to e.g. instantiate an XCCDF
we can change the underlying implementation without breaking the
Answering a bit to myself, Jan also supports this, and it is not really
Similarly, items proposed by Jan s.a speeding the build up and replacing
shared remediation functions with macros aren't breaking either and can
be done gradually.
Vojta's item, reorg of templates, could break the internal API, but as
we got zero complaints about our last template reorg, that proves that
nobody else cares about how templates are implemented, so that one is
not a breaking change either.
Now Gabe's items:
- Merging platform and prodtype together
That's IMO a great
candidate - it can break things, but this duality is
indeed very confusing. It was also proposed by Jan
- getting rid of jinja in rules and using the industry standard of
tailoring to increase readability
I don't understand this one.
First of all, what is meant by "industry standard of tailoring"?
And what is the problem of having jinja in rules? As we have templated
rules, it is obvious that there will be a lot of repetition in
description, rationale and OCIL, and jinja is a good way how to avoid
- Divorce the content from the build system like Chef Inspec,
and other security tooling that is coming from the government.
content from the build system is also proposed by Jan,
and I am on board.
I have problems understanding the precise meaning of the second part of
the sentence "... like Chef Inspec, ... and other tooling". What is
meant by that? That we should be able to build not only datastreams, but
e.g. Ansible playbooks?
- Feedback from many consultants and SAs is that things need to be
made easier and simpler. That it's too hard to do anything.
We could have
various ideas how to improve this, but the really serious
way how to address this would be to conduct a UX study, and then
allocate a considerable amount of time to address findings. Consultants
and SAs should go through the SecurityLabs self-paced training before
trying to do anything serious in the project, that will save them quite
a lot of time.
- Moving all product configurations necessary to add a new product
from code to product.yml
I am totally on board as well. I wouldn't see it as a breaking change