> Several participants in the thread "Re: New report and guide in openscap > 1.1.0" > raised concerned over a language "The system is not compliant!" in the > report. I decided to avoid using the word compliant at all in this case. XCCDF spec defines what it means on the report but people may think the word has a different meaning and may be shocked. So instead I decided to explicitly say how many rules failed or were inconclusive. For example: "The target system did not satisfy conditions of 131 rules! Furthermore, the results of 2 rules were inconclusive. Please review rule results and consider applying remediation."

> > So instead I decided to explicitly say how many rules failed or were > > inconclusive. > > > > For example: > > "The target system did not satisfy conditions of 131 rules! Furthermore, > > the results of 2 rules were inconclusive. Please review rule results > > and consider applying remediation." > > Inconclusive is a word that I would not use. It prejudices the results by > indicating that something may or may not be wrong and it can't really > tell. That is exactly the case. It's not prejudice, it's fact.

On 9/2/14, 11:43 AM, Martin Preisler wrote: ----- Original Message ----- > From: "Steve Grubb" <sgrubb(a)redhat.com&gt; <sgrubb(a)redhat.com&gt;&gt; To: scap-security-guide(a)lists.fedorahosted.org&gt; Cc: "Martin Preisler" <mpreisle(a)redhat.com&gt; <mpreisle(a)redhat.com&gt;&gt; Sent: Tuesday, September 2, 2014 5:33:05 PM> Subject: Re: Best ways to say this system is not compliant> > On Tuesday, September 02, 2014 08:48:17 AM Martin Preisler wrote: > > > Several participants in the thread "Re: New report and guide in openscap> > > 1.1.0"> > > raised concerned over a language "The system is not compliant!" in the> > > report. > > > > I decided to avoid using the word compliant at all in this case.> > XCCDF spec defines what it means on the report but people may think> > the word has a different meaning and may be shocked.> > > > So instead I decided to explicitly say how many rules failed or were> > inconclusive.> > > > For example:> > "The target system did not satisfy conditions of 131 rules! Furthermore,> > the results of 2 rules were inconclusive. Please review rule results> > and consider applying remediation." > > Inconclusive is a word that I would not use. It prejudices the results by> indicating that something may or may not be wrong and it can't really tell. That is exactly the case. It's not prejudice, it's fact. > That's not the message I want from any tool. Imagine running badblocks, aide,> or find and the message output is that it's inconclusive. :-)> > I'd simply say something to the effect that the scan has findings that need> to> be reviewed. Short & simple. The report says "inconclusive" for rules 'error' or 'unknown' as cdf:result. Excerpt from XCCDF 1.2 spec: error - The checking engine could not complete the evaluation, therefore the status of the target's compliance with the rule is not certain. This could happen, for example, if a testing tool was run with insufficient privileges and could not gather all of the necessary information. unknown - The testing tool encountered some problem and the result is unknown. For example, a result of 'unknown' might be given if the testing tool was unable to interpret the output of the checking engine (the output has no meaning to the testing tool). I am not a native speaker but I am pretty sure inconclusive is the right word for this. If not, please provide an alternative. Would it be possible to add a tooltip/hover so that when people mouse over the "Rule Overview" check boxes they would see these definitions? Many find the differences between notchecked, notselected, and notapplicable confusing... and really, to someone who hasn't read the xccdf spec, that's entirely understandable. -- SCAP Security Guide mailing list scap-security-guide(a)lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide https://github.com/OpenSCAP/scap-security-guide/

From: "Shawn Wells" <shawn(a)redhat.com&gt; To: scap-security-guide(a)lists.fedorahosted.org Sent: Tuesday, September 2, 2014 7:54:15 PM Subject: Re: Best ways to say this system is not compliant [snip] Would it be possible to add a tooltip/hover so that when people mouse over the "Rule Overview" check boxes they would see these definitions? Many find the differences between notchecked, notselected, and notapplicable confusing... and really, to someone who hasn't read the xccdf spec, that's entirely understandable.

From: "Shawn Wells" <shawn(a)redhat.com&gt; To: scap-security-guide(a)lists.fedorahosted.org Sent: Thursday, September 4, 2014 6:12:20 AM Subject: Re: Best ways to say this system is not compliant On 9/3/14, 7:38 AM, Martin Preisler wrote: > ----- Original Message ----- >> > From: "Shawn Wells" <shawn(a)redhat.com&gt; >> > To: scap-security-guide(a)lists.fedorahosted.org >> > Sent: Tuesday, September 2, 2014 7:54:15 PM >> > Subject: Re: Best ways to say this system is not compliant >> > >> > [snip] >> > >> > Would it be possible to add a tooltip/hover so that when people mouse >> > over the "Rule Overview" check boxes they would see these definitions? >> > >> > Many find the differences between notchecked, notselected, and >> > notapplicable confusing... and really, to someone who hasn't read the >> > xccdf spec, that's entirely understandable. > We have tooltips over the rule results themselves but you are right that > having them in the box in Rule Overview would be better. > > I'll make a patch. Thanks! Absolutely no rush or anything: could you re-spin the samples off your fedorapeople page? It'd be great to see how all these changes have been incorporated (the code presents some insight, but it's funner to play around on the html page).

btw - I was at a customer site today who made a comment that they've been watching this thread and really loving where the report is heading. these design improvements are really going far to show responsiveness to the user community, and generally making OpenSCAP reports badass :)