Short form references

[Gabe Alford]

Hello,

Currently for references (STIGID, NIST, CUI, etc.) in our yaml content, we
use a form of shortening
the reference for STIGID and CCI e.g.

For CCI, we do something like the following:

```
disa: 2165,2696
```

For STIGID, we do something like the following:

```
stigid: "020210"
```

This is was nice in the day that we only had just RHEL content, but now, we
have Oracle, SuSE, Ubuntu, and the framework for macOS. Also, it would be
nice to keep the build system agnostic
of different reference identifiers formats for different platforms. Many
users just copy/paste the
references or use script changes in some way. Other repos use the full
notation. As the STIGID
and CCI are the only 2 references we short form, I am thinking that we
should remove this short
form notation and replace with the full notation to make it easier to
script and copy/paste changes
in addition to making it an easier experience for users coming from
different repositories.

What do you think? Keep the same form? Use the full notation?

Thanks for your time,

Gabe

[Rich Lucente]

I wholeheartedly endorse using the full reference as shortening, for
example, can make traceability checks harder.

[Shawn Wells]

On 3/26/20 1:21 PM, Rich Lucente wrote:
> I wholeheartedly endorse using the full reference as shortening, for 
> example, can make traceability checks harder.

+1

Was the right call back in the day. Project and content has evolved since.

[Ilya Okomin]

+1

At first glance shortened values look a bit confusing with need to wrap
in quotes single int like values to handle in scripts properly.
For sure it can be identified and handled finally but having full
reference would be consistent to me and more convenient for search and
update.

Best regards,
Ilya.
On 3/26/2020 11:12 AM, Shawn Wells wrote:
> On 3/26/20 1:21 PM, Rich Lucente wrote:
> > I wholeheartedly endorse using the full reference as shortening, for
> > example, can make traceability checks harder.
>
> +1
>
> Was the right call back in the day. Project and content has evolved
> since.
> _______________________________________________
> scap-security-guide mailing list --
> [e-mail]
> To unsubscribe send an email to
> [e-mail]
> Fedora Code of Conduct:
> https://urldefense.com/v3/__https://docs.fedoraproject.org/en-US/project/cod...
> List Guidelines:
> https://urldefense.com/v3/__https://fedoraproject.org/wiki/Mailing_list_guid...
> List Archives:
> https://urldefense.com/v3/__https://lists.fedorahosted.org/archives/list/sca...

[Watson Sato]

On Thu, Mar 26, 2020 at 6:13 PM Gabe Alford  wrote:
> Hello,
>
> Currently for references (STIGID, NIST, CUI, etc.) in our yaml content, we
> use a form of shortening
> the reference for STIGID and CCI e.g.
>
> For CCI, we do something like the following:
> disa: 2165,2696
> For STIGID, we do something like the following:
> stigid: "020210"

Looks like a good call, would the long forms for the examples be CCI-2696
and RHEL-07-020210?
> This is was nice in the day that we only had just RHEL content, but now,
> we have Oracle, SuSE, Ubuntu, and the framework for macOS. Also, it would
> be nice to keep the build system agnostic
> of different reference identifiers formats for different platforms. Many
> users just copy/paste the
> references or use script changes in some way. Other repos use the full
> notation. As the STIGID
> and CCI are the only 2 references we short form, I am thinking that we
> should remove this short
> form notation and replace with the full notation to make it easier to
> script and copy/paste changes
> in addition to making it an easier experience for users coming from
> different repositories.
>
> What do you think? Keep the same form? Use the full notation?
>
> Thanks for your time,
>
> Gabe
> _______________________________________________
> scap-security-guide mailing list --
> [e-mail]
> To unsubscribe send an email to
> [e-mail]
> Fedora Code of Conduct:
> https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
> https://lists.fedorahosted.org/archives/list/[e-mail]...

[Matěj Týč]

Sorry, I am not 100% sure about what's meant by short vs long notation.

On Čt, bře 26, 2020 at 10:48, Gabe Alford  
wrote:
> ... we use a form of shortening
> the reference for STIGID and CCI e.g.
>
> For CCI, we do something like the following:
> disa: 2165,2696

Is the shortening about product qualifiers? For example disa@rhel6: is 
the full reference,  and disa: the shortened form?
If this is the case, then I would like to point out that we can very 
easily enforce usage of the full form on selected references by 
tweaking the build system.