smengcl opened a new pull request, #11451: URL: https://github.com/apache/ozone/pull/11451
Generated-by: Claude Code (Opus 5.5) ## What changes were proposed in this pull request? `THREAT_MODEL.md` does not mention availability. Section 8 lists six security properties and none of them covers it, and section 9 does not disclaim it either. A report that a request stops a service therefore has no disposition in section 13, and a triager cannot tell whether it is `VALID` or `BY-DESIGN`. This adds the missing statement in both directions. What Ozone provides (section 8, new item 7): a small, fixed number of requests from an untrusted client or an authenticated non-admin user does not terminate or hang an Ozone service process, and does not leave the service unable to serve other users. What Ozone does not provide (section 9): * Withstanding load by volume, such as request floods and connection exhaustion. Limiting that is the operator's job. * Protection against a user consuming resources within the limits the operator granted. * Availability against admins or compromised service peers. Matching edits so the rest of the document agrees: the adversary list (section 7), operator guidance on quotas, FairCallQueue and rate limiting in front of S3 Gateway (section 10), known non-findings (section 11a), and the triage dispositions table (section 13). ## What is the link to the Apache JIRA https://issues.apache.org/jira/browse/HDDS-16800 ## How was this patch tested? - n/a -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
