[Open-scap] SCAP ecosystem test day results
Martin Preisler
mpreisle at redhat.com
Fri Sep 19 10:38:49 UTC 2014
----- Original Message -----
> From: "Martin Preisler" <mpreisle at redhat.com>
> To: "open-scap-list" <open-scap-list at redhat.com>, scap-workbench at lists.fedorahosted.org, "SCAP Security Guide"
> <scap-security-guide at lists.fedorahosted.org>
> Cc: "Martin Zember" <mzember at redhat.com>
> Sent: Thursday, September 18, 2014 3:22:05 PM
> Subject: [Open-scap] SCAP ecosystem test day results
>
> [snip]
>
> openscap specific:
>
> * openscap doesn't include any content, yet it was expected of it
> - user tried to look for "some version of openscap that can do
> USGCB"
>
> * if user selects a profile ID that's not in the content, openscap
> should either print `oscap info` on the file to help or at
> least hint the existence of `oscap info`.
https://fedorahosted.org/openscap/ticket/395
> * ssg custom repo in documentation, outdated...
Fixed.
> * user didn't notice a report has already been generated using
> --report and generated it again
Not sure what to do about this, the docs are fairly clear already :-/
> * confusion about OVAL results and check system details
Should be much improved with
https://fedorahosted.org/openscap/ticket/396
>
> [snip]
>
> scap-workbench specific:
>
> * user at target placeholder text disappears when you paste IP
> there. Then user doesn't realize that user@ can also go there.
No idea what to do about this :-(
> * Where does workbench get ssh password? User first searched
> for input boxes or settings before starting the scan and
> filling out the ssh-askpass box.
No idea what to do about this either. I want to avoid workbench
storing or even handling any ssh credentials anywhere.
> * Ctrl+F or / was expected to search in both main window
> and tailoring window.
https://fedorahosted.org/scap-workbench/ticket/234
> * Enter doesn't confirm search in tailoring window, user had
> to click
https://fedorahosted.org/scap-workbench/ticket/235
> * No visualization of dependencies between rules and values
https://fedorahosted.org/scap-workbench/ticket/229
> * Save content vs Save tailoring, what is the difference,
> what do I want to use?
https://fedorahosted.org/scap-workbench/ticket/236
> * The user manual was not used unless explicitly talked about.
No idea how to convince users to use the manual, workbench even
has Help -> User Manual which opens it in the web browser.
Any suggestions welcome here.
> * Opening tailoring file directly doesn't automatically open
> the content and then the tailoring file.
We should be able to fix this but it will require changes in both
openscap and scap-workbench.
https://fedorahosted.org/scap-workbench/ticket/237
> * scap-workbench is not all that much advertised on
> scap-security-guide or openscap web pages. It is therefore
> quite hard to discover it.
I added scap-workbench to Documentation introduction but the truth
is that users probably skip past that. Not sure what else to do,
it makes no sense to hint scap-workbench in every example listed
there.
--
Martin Preisler
More information about the scap-security-guide
mailing list