[RFC] time to move to github?

Greg Elin gregelin at gitmachines.com
Thu Feb 20 12:34:57 UTC 2014


On Wed, Feb 19, 2014 at 2:39 PM, Gary Gapinski <gapinski at nasa.gov> wrote:

>
> Our intent is to score a subset of all checklist items but have all items
> evaluated on all systems. This requires allĀ¹ <Rule>s to be selected.
>
> A <Profile> cannot alter the roleĀ² attribute of a <Rule> (to unscored
> rather than full).
>
>
This is an interesting use case I relate to: wanting to know results of all
tests, but only really caring about a subset.

For example, the current/default XCCDF report format via OSCAP does not
summarize pass/fail by severity.  In the scan I am using there are only 17
critical controls.  Don't I want my reports to guide where I put my
attention first?  It's on my ist to change that for my needs.

Being able to categorize system state and then apply varying states against
varying contexts is highly useful for prioritizing and analysis, IMO. Do I
want to take automatic actions according to some algorithm of tests and
criticality?  Is pass/fail really a binary or even a scalar operation, or
is it more flexible and context driven?

I well know the anxiousness from someone forking my carefully-crafted
software to use in unintended ways. I also know the joy of finding open
source code that I can bend to my use case.

Openness means never having to say your sorry for forking around.
 Experiments are the driving force of evolution.

Greg Elin
personal cell: 917-304-3488
personal email: greg at fotonotes.net
email: gregelin at gitmachines.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20140220/244af408/attachment.html>


More information about the scap-security-guide mailing list