[Open-scap] SCAP ecosystem test day results

Martin Preisler mpreisle at redhat.com
Fri Sep 19 10:38:49 UTC 2014


----- Original Message -----
> From: "Martin Preisler" <mpreisle at redhat.com>
> To: "open-scap-list" <open-scap-list at redhat.com>, scap-workbench at lists.fedorahosted.org, "SCAP Security Guide"
> <scap-security-guide at lists.fedorahosted.org>
> Cc: "Martin Zember" <mzember at redhat.com>
> Sent: Thursday, September 18, 2014 3:22:05 PM
> Subject: [Open-scap] SCAP ecosystem test day results
> 
> [snip]
> 
> openscap specific:
> 
>  * openscap doesn't include any content, yet it was expected of it
>    - user tried to look for "some version of openscap that can do
>      USGCB"
> 
>  * if user selects a profile ID that's not in the content, openscap
>    should either print `oscap info` on the file to help or at
>    least hint the existence of `oscap info`.

https://fedorahosted.org/openscap/ticket/395

>  * ssg custom repo in documentation, outdated...

Fixed.

>  * user didn't notice a report has already been generated using
>    --report and generated it again

Not sure what to do about this, the docs are fairly clear already :-/

>  * confusion about OVAL results and check system details

Should be much improved with
https://fedorahosted.org/openscap/ticket/396

> 
> [snip]
> 
> scap-workbench specific:
> 
>  * user at target placeholder text disappears when you paste IP
>    there. Then user doesn't realize that user@ can also go there.

No idea what to do about this :-(

>  * Where does workbench get ssh password? User first searched
>    for input boxes or settings before starting the scan and
>    filling out the ssh-askpass box.

No idea what to do about this either. I want to avoid workbench
storing or even handling any ssh credentials anywhere.

>  * Ctrl+F or / was expected to search in both main window
>    and tailoring window.

https://fedorahosted.org/scap-workbench/ticket/234

>  * Enter doesn't confirm search in tailoring window, user had
>    to click

https://fedorahosted.org/scap-workbench/ticket/235

>  * No visualization of dependencies between rules and values

https://fedorahosted.org/scap-workbench/ticket/229

>  * Save content vs Save tailoring, what is the difference,
>    what do I want to use?

https://fedorahosted.org/scap-workbench/ticket/236

>  * The user manual was not used unless explicitly talked about.

No idea how to convince users to use the manual, workbench even
has Help -> User Manual which opens it in the web browser.

Any suggestions welcome here.

>  * Opening tailoring file directly doesn't automatically open
>    the content and then the tailoring file.

We should be able to fix this but it will require changes in both 
openscap and scap-workbench.

https://fedorahosted.org/scap-workbench/ticket/237

>  * scap-workbench is not all that much advertised on
>    scap-security-guide or openscap web pages. It is therefore
>    quite hard to discover it.

I added scap-workbench to Documentation introduction but the truth
is that users probably skip past that. Not sure what else to do,
it makes no sense to hint scap-workbench in every example listed
there.

-- 
Martin Preisler


More information about the scap-security-guide mailing list