yes, I'm planning to come too. Can't wait to drink beer -- I mean discuss SECURITY
On Mon, Aug 31, 2026 at 2:52 PM Michael McCandless <[email protected]> wrote: > > I'm also planning to attend CoC Glasgow and would love to join the hackathon, > time/talks permitting! > > A few more of us (from Amazon customer facing product search team, using > Lucene to search all of Amazon's fast-changing catalog) are hoping/planning > to come too... > > Mike McCandless > > http://blog.mikemccandless.com > > On Thu, Aug 20, 2026 at 5:36 AM Uwe Schindler via dev <[email protected]> > wrote: >> >> Hi, >> >> I will also be there. I'd like to discuss a bit about a SECURITY.md in our >> repository and some ideas what we should treat as security vulnerability and >> what not. Not only about idex files and possibly missing checks in public >> APIs. Also with regards to XML queryparser, serialization and so on - >> although those are mot of the cases security related and should be fixed. >> >> The reason why I am bringing that up: We recently got many - and rejected >> security issues from people forcefully flipping specific bits and bytes in a >> Lucene index file (and also fixing the checksum) and later said: "Theres a >> DOS attack because of an infinite loop while reading that file." We all know >> that we often cannot do checks at every possibly entry point and our code >> trusts that the index/codec file format is sane. Of course we can improve >> that, but only without affecting performance. Therefore I'd like to mock up >> a SECUIRTY.md file for the Lucene repo where we clearly say that an index >> file must be coming from a trusted location and unauthorized modifications >> on index files should be prevented by the downstream application (like >> Elasticsearch/Solr doing a full cryptographic handshake when transferring >> files over the network). >> >> I'd like to discuss and maybe hack a bit. So your inviation is great! And >> some (many) beers are important, too! >> >> Uwe >> >> Am 19.08.2026 um 06:08 schrieb Sagar Upadhyay: >> >> Hello, >> >> I am also coming to CoC Glasgow for a talk and would be really interested in >> this! >> >> ~ Sagar >> >> On Tue, Aug 18, 2026, 7:27 AM Alan Woodward <[email protected]> wrote: >>> >>> Hi everyone, >>> >>> I’ve just signed up for CoC in Glasgow this October, and I see that there >>> is already a proposal for a Solr hackathon on the Monday. Would anybody be >>> interested in a parallel Lucene group as well? In the past these have been >>> fun opportunities to meet up with other committers and contributors and to >>> brainstorm future ideas as well as work together on bug fixes and new >>> features. If enough people think it’s worth it I can try and set something >>> up. >>> >>> - Alan >>> --------------------------------------------------------------------- >>> To unsubscribe, e-mail: [email protected] >>> For additional commands, e-mail: [email protected] >>> >> -- >> Uwe Schindler >> Achterdiek 19, D-28357 Bremen >> https://www.thetaphi.de >> eMail: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
