Hi,
I will also be there. I'd like to discuss a bit about a SECURITY.md in
our repository and some ideas what we should treat as security
vulnerability and what not. Not only about idex files and possibly
missing checks in public APIs. Also with regards to XML queryparser,
serialization and so on - although those are mot of the cases security
related and should be fixed.
The reason why I am bringing that up: We recently got many - and
rejected security issues from people forcefully flipping specific bits
and bytes in a Lucene index file (and also fixing the checksum) and
later said: "Theres a DOS attack because of an infinite loop while
reading that file." We all know that we often cannot do checks at every
possibly entry point and our code trusts that the index/codec file
format is sane. Of course we can improve that, but only without
affecting performance. Therefore I'd like to mock up a SECUIRTY.md file
for the Lucene repo where we clearly say that an index file must be
coming from a trusted location and unauthorized modifications on index
files should be prevented by the downstream application (like
Elasticsearch/Solr doing a full cryptographic handshake when
transferring files over the network).
I'd like to discuss and maybe hack a bit. So your inviation is great!
And some (many) beers are important, too!
Uwe
Am 19.08.2026 um 06:08 schrieb Sagar Upadhyay:
Hello,
I am also coming to CoC Glasgow for a talk and would be really
interested in this!
~ Sagar
On Tue, Aug 18, 2026, 7:27 AM Alan Woodward <[email protected]> wrote:
Hi everyone,
I’ve just signed up for CoC in Glasgow this October, and I see
that there is already a proposal for a Solr hackathon on the
Monday. Would anybody be interested in a parallel Lucene group as
well? In the past these have been fun opportunities to meet up
with other committers and contributors and to brainstorm future
ideas as well as work together on bug fixes and new features. If
enough people think it’s worth it I can try and set something up.
- Alan
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
--
Uwe Schindler
Achterdiek 19, D-28357 Bremen
https://www.thetaphi.de
eMail:[email protected]
