[Open-scap] SCAP ecosystem test day results

Trevor Vaughan tvaughan at onyxpoint.com
Fri Sep 19 14:47:22 UTC 2014


Comments Inline....


[snip]



>
> >  * user didn't notice a report has already been generated using
> >    --report and generated it again
>
> Not sure what to do about this, the docs are fairly clear already :-/
>


Can you detect previously generated reports and have something obvious to
open them?


> >
> >  * user at target placeholder text disappears when you paste IP
> >    there. Then user doesn't realize that user@ can also go there.
>
> No idea what to do about this :-(
>

Tooltip?


>
> >  * Where does workbench get ssh password? User first searched
> >    for input boxes or settings before starting the scan and
> >    filling out the ssh-askpass box.
>
> No idea what to do about this either. I want to avoid workbench
> storing or even handling any ssh credentials anywhere.
>

Honestly, most scanning apps let you do this. Store it in memory and make
sure that it's not cached I suppose.


>
> >  * The user manual was not used unless explicitly talked about.
>
> No idea how to convince users to use the manual, workbench even
> has Help -> User Manual which opens it in the web browser.
>
> Any suggestions welcome here.
>

This is probably a good thing. If the manual wasn't used, it indicates that
the interface was reasonably intuitive for general use. The only other
thing that you could do is to add 'help' buttons beside each input item
that jump you to the relevant sections of the docs. This is how most tools
that I've used do it.


>
> >  * scap-workbench is not all that much advertised on
> >    scap-security-guide or openscap web pages. It is therefore
> >    quite hard to discover it.
>
> I added scap-workbench to Documentation introduction but the truth
> is that users probably skip past that. Not sure what else to do,
> it makes no sense to hint scap-workbench in every example listed
> there.
>

In any example code, add something like 'Generated with scap-workbench
<link>

Trevor Vaughan
Vice President, Onyx Point, Inc
(410) 541-6699
tvaughan at onyxpoint.com

-- This account not approved for unencrypted proprietary information --
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20140919/738109d6/attachment.html>


More information about the scap-security-guide mailing list