http://openscap-lhorakov.rhcloud.com/resources/documentation/scan-a-docker-container-for-vulnerabilities-or-compliance/

Explain oscap-docker, practical example with USGCB and vuln scan. Link to vuln scan of RHEL6 for more info about vulnerability assessment.

Sources:
https://github.com/OpenSCAP/openscap/blob/maint-1.2/utils/oscap-docker.8
https://github.com/OpenSCAP/container-compliance
(but keep in mind that oscap-docker is now part of OpenSCAP, this repo will likely be decommissioned at some point!)

http://openscap-lhorakov.rhcloud.com/resources/documentation/make-a-rhel7-server-compliant-with-pci-dss/

Sources:
http://static.open-scap.org/ssg-guides/ssg-rhel7-guide-pci-dss.html
@iankko
OpenSCAP evaluation remediation docs

http://openscap-lhorakov.rhcloud.com/wp-content/uploads/2015/07/banner2.png
http://openscap-lhorakov.rhcloud.com/wp-content/uploads/2015/07/banner3.png

Lets battle the trend of web pages getting insanely huge. These two images take roughly 1.7 MB. That's dangerously close to the size of the entire Doom1 PC game - see https://pbs.twimg.com/media/CLLGenwWgAAZAVv.png. Both images are full of hard-to-compress gradients that would take a tiny fraction of the size in SVG format.

AFAIK the only problem is IE8 and lower, see http://caniuse.com/#feat=svg The probability that somebody would have a 4k monitor and IE8 is very close to 0.

It's not just bandwidth, the sizes make the page very RAM hungry and sluggish on slower devices. The devices have to decompress this huge PNG and store each pixel's color. Then the images have to be scaled using bilinear filtering.

Create different coloured icons for them to better look and to send messega for user that also there is someone hidden.

The "here" button in the "8. View and Analyze Results" section of the USGCB tutorial isn't very visible. Is this 1.0?

The SCE page is content-ready. It should be formatted to look more consistent with the rest of the website.

https://openscap-lhorakov.rhcloud.com/features/other-standards/sce/

We should create/improve developer documentation for OpenSCAP project.

We should take pages

    http://www.open-scap.org/page/Contribute/Ideas
    http://www.open-scap.org/page/Contribute

And perhaps merge them into CONTRIBUTE.md in OpenSCAP/openscap repo.

http://openscap-lhorakov.rhcloud.com/resources/documentation/disa-stig-compliance-on-rhel5/

Sources:
http://www.open-scap.org/page/Documentation#How_to_Evaluate_Defense_Information_Systems_Agency_.28DISA.29_Security_Technical_Implementation_Guide_.28STIG.29_on_Red_Hat_Enterprise_Linux_5

Right now the portal lists all posts when 404 is encountered.

See http://openscap-lhorakov.rhcloud.com/asdfasdf

In previous discussions around SCAP Workbench we decided to use the term customization instead of tailoring. It is more commonly understood, especially for non-native speakers.

In the portal however, the page is called Tailoring and we primarily use the term tailoring in there.

IMO either we decide that the decision in the past is wrong and workbench changes or the portal should change.

Currently we host using the Free plan on @lhorakov 's account. I have applied for employee subscription and was granted Silver plan for OpenSCAP. I have created the rhopenscap domain on OpenShift with this plan and have given @lhorakov rights to administer it.

Advantages of rhopenscap:

• the app will never idle
• it is a paid plan so the support is better
• more storage, faster website - load balancer and all those other fancy things
• OpenSCAP team has access to it
• sits right next to the static app that serves static.open-scap.org

How to do this:

• Create snapshot of the app on @lhorakov 's account
• Create a Wordpress app on rhopenscap
• Restore snapshot on the new app

It will kill all the openscap-lhorakov.rhcloud.com links so I suggest doing this right before GA.

It could help users to read text without switching betwen text/acronym page.

Heading of the page says:

We know you care about other standards too

It is nice that we know that, but we do not give you any solution :-)

And also:

For security compliance, there are also other standards different from SCAP. We make sure, our solution is well interoperable with them.

I do not understand how is OpenSCAP interoperable with SACM or SWID if OpenSCAP do not implement these.

https://nvd.nist.gov/scap/validation/128.cfm

The use of JavaScript language in pages brings a lot of capabilities when compared to completely static HTML pages.

On the other hand, many government agencies / corporate policies might require JavaScript support to be disabled in web browsers the system to be compliant.

Therefore we should ensure all portal pages work correctly (provide equivalent user experience) in both cases:

• JS is enabled,
• JS is disabled.

http://openscap-lhorakov.rhcloud.com/resources/documentation/perform-vulnerability-scan-of-rhel-6-machine/

sources:
http://www.open-scap.org/page/Documentation#How_to_run_vulnerability_scan_on_Red_Hat_Enterprise_Linux
https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Security_Guide/sect-Practical_Examples.html#sect-Auditing_Security_Vulnerabilities_Example

optional sources:
http://isimluk.livejournal.com/5655.html

The tutorial should reflect latest developments around bzip2, datastreams, split RHSAs per product. Ping Simon or Martin for info on these, AFAIK there is no good source yet for these.

It will be implemented in phase 2. Github personal icon or Blog icon and so, into personal descriptions of each person in about team.

At the components page, there is XCCDF 1.1 tailoring example. The example however, seems to relate to SCE and that is confusing.

Short introduction to XCCDF 1.1 Tailoring is however missing. Also, we need this anchor /features/scap-components/#xccdf-11-tailoring for redirects (see #12).

The old portal at http://www.open-scap.org/page/Xccdf-1.1-tailoring reads:

XCCDF 1.1 Tailoring extension

NOTE: Text on this page will apply when openscap 0.9.12 is released.

openscap 0.9.12 introduces an extension to XCCDF 1.1 specification that allows tools and users to create tailoring files even for XCCDF 1.1 content. 

http://openscap-lhorakov.rhcloud.com/features/standards/

'Other standards' page will contain SCAP standards which are not implemented by openscap and standards implemented by openscap but not in SCAP standards.

The page is not still completed, so do not solve the ticket before it will be.

For now the links for user manual at OpenSCAP Base points to github. After make install will build the manual I'll edit the job on the Jenkins and correct the links so they point to the static.open-scap.org.

http://openscap-lhorakov.rhcloud.com/resources/documentation/rhel5-and-united-states-government-configuration-baseline-usgcb/

Sources:
http://www.open-scap.org/page/Documentation#How_to_Evaluate_United_States_Government_Configuration_Baseline_.28USGCB.29_on_Red_Hat_Enterprise_Linux_5

Perhaps some CSS piece missing?

http://openscap-lhorakov.rhcloud.com/resources/documentation/customizing-scap-security-guide-for-your-use-case/

Go over specific customization. Show examples of something practical. SSH root login is a very common compromise. Password length is also very common.

Sources:
http://static.open-scap.org/scap-workbench-1.1/

On this page http://openscap-lhorakov.rhcloud.com/tools/scap-workbench/ is link for more detailed documentation, in section documentation: "Evaluate remote machine for USGCB compliance August 19, 2015 msrubar".

BUT the link is missing if you are random user of portal (if your are NOT logged in).

It should contain the title of the page instead.

• Hosting new guides
• Hosting screenshots needed by openscap base docuementation
• Hosting our API documentation

Or remove them before release.

Documentation from fedorahosted page has been already migrated to the new portal page.

SCAP Security Guide can be the header and the list can only contain the OS version.

SCAP Security Guides:

• RHEL6
• RHEL7
• ...

This avoids repeating SCAP Security Guide multiple times.

Today, we have some developer info behind firewall. No reason for hiding this.

It would be awesome if we had with each title of tutorial documentation also showed the first paragraph of article...

Please, add some favicon to portal web.

Parts of the documentation from fedorahosted page has been already migrated to the scap-security-guide wiki. Parts have been moved to the new portal.

We need to search for remaining references in man page, git, and documentation (upstream & downstream). Then we can take down scap-security-guide page.

I think it would look better to have the Red Hat logo on the web. Something like this:

Particularly, we have many other sources referencing following pages:

http://www.open-scap.org/page/Main_Page (many sources, out of our reach)
http://www.open-scap.org/page/SCE (many pages, some out of our reach)
http://www.open-scap.org/page/Contribute (our openscap-base documentation)

"Choosing policy" page points to HTML guides for RHELs and Fedora, but it would be nice to be able to link there also HTML guides for Firefox and Java, because we mention these policies in section "Security policies available in the SCAP Security Guide".

UX, visuals, design.

See #4. @mpreisler can provide access to the OpenShift instance and Jenkins job.

Description of problem:

Selecting (clicking at) some of "1" .. "5" circles in How OpenSCAP Ecosystem Can Help section of the Vulnerability Assessment page displays black square around the circle when selected. Remove it
(see the picture below for clarification).

Please give us a break! :-)

The OpenSCAP WP theme says it is authored by Zac Gordon who AFAIK is the author of the parent theme.

http://openscap-lhorakov.rhcloud.com/wp-content/themes/wpbootstrap-openscap/style.css

The header of this file needs to be changed.

at https://github.com/OpenSCAP/scap-security-guide/wiki

If you need lightbox for an acronym at your page, please put it to the comments section.

I think it would be a good idea to put something like:

Some piece of information is missing? Sth is not clear? ... Please let us know at irc, mailing list

at the end of each tutorial. It could help us to continuously improve our tutorials.

Screens was taken from the SCAP-Workbench page.

http://openscap-lhorakov.rhcloud.com/resources/documentation/security-compliance-of-rhel7-docker-containers/

Sources:
https://jlieskov.wordpress.com/2015/07/17/scanning-container-images-on-red-hat-enterprise-linux-atomic-host-v-7-using-oscap-docker-and-scap-security-guide/

The old URLs need to stay alive forever if possible. Putting it here so that we don't forget before GA.

/page/SCE -> /features/other-standards/sce/
/page/SCE_result_file -> /features/other-standards/sce/#sce-result-file