pjfanning opened a new pull request, #3760: URL: https://github.com/apache/pekko/pull/3760
### Motivation `THREAT_MODEL.md` was written against `90b02d60` and still carried the drafting scaffolding: provenance tags on every claim, the thirteen-question review section, and the back-map appendix. During review of #3478 it was noted that the draft/status material would go once the questions were answered. Since then `main` has also gained several wire-input bounds, a corrected SHA1PRNG note and new TLS guidance that the model did not reflect. ### Modification - **Less verbose:** the §14 rulings are folded into the sections they govern, and §14 is now a short report → disposition table. The provenance legend/counts and the §15 back-map are gone. §1–§13 keep their numbers, so `SECURITY.md`/`AGENTS.md` references still resolve. 424 → 255 lines, about 52 KB → 22 KB. - **§5a:** adds `pekko.serialization.max-decompressed-size` and `pekko.serialization.jackson(3).compression.max-decompressed-size` (both `unlimited`, compatibility defaults, #3502/#3515/#3491) and `serialization-max-nesting-depth = 32` (#3500). - **§8 P8:** wire input can't cost disproportionately more than its size. This states the Q8 ruling as a property and covers the frame-length (#3492), nesting-depth and compression-advertisement (#3510) bounds plus the fatal-error → node-loss path. Decompression bombs under the `unlimited` default are `BY-DESIGN: default-configuration`; a bypass of a configured limit is `VALID`. - **P4:** the allow list is now checked before constructor args are deserialized (#3493). - **§6:** HOCON includes in config that arrives over the wire are not resolved (#3505), DNS parsing is Pekko's (#3490), and stream decompression bounds (zstd window limit, #3710) are noted. - **§5 / §11a:** the stale SHA1PRNG/`urandom` text is replaced to match #3481. - **§9 / §10:** points at `verifyClientSession`/`verifyServerSession` for per-node identity (#3462). - Drops `reference.conf` line-number citations, which had already drifted. No ruling changes meaning. ### Result The threat model matches current `main` and is shorter and easier to cite. ### Tests - Not run - docs only ### References Refs #3478 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
