Re: Community over Code Glasgow

Hi,

I will also be there. I'd like to discuss a bit about a SECURITY.md in 
our repository and some ideas what we should treat as security 
vulnerability and what not. Not only about idex files and possibly 
missing checks in public APIs. Also with regards to XML queryparser, 
serialization and so on - although those are mot of the cases security 
related and should be fixed.

The reason why I am bringing that up: We recently got many - and 
rejected security issues from people forcefully flipping specific bits 
and bytes in a Lucene index file (and also fixing the checksum) and 
later said: "Theres a DOS attack because of an infinite loop while 
reading that file." We all know that we often cannot do checks at every 
possibly entry point and our code trusts that the index/codec file 
format is sane. Of course we can improve that, but only without 
affecting performance. Therefore I'd like to mock up a SECUIRTY.md file 
for the Lucene repo where we clearly say that an index file must be 
coming from a trusted location and unauthorized modifications on index 
files should be prevented by the downstream application (like 
Elasticsearch/Solr doing a full cryptographic handshake when 
transferring files over the network).

I'd like to discuss and maybe hack a bit. So your inviation is great! 
And some (many) beers are important, too!

Uwe

Am 19.08.2026 um 06:08 schrieb Sagar Upadhyay:
> Hello,
>
> I am also coming to CoC Glasgow for a talk and would be really 
> interested in this!
>
> ~ Sagar
>
> On Tue, Aug 18, 2026, 7:27 AM Alan Woodward <[email protected]> wrote:
>
>     Hi everyone,
>
>     I’ve just signed up for CoC in Glasgow this October, and I see
>     that there is already a proposal for a Solr hackathon on the
>     Monday.  Would anybody be interested in a parallel Lucene group as
>     well?  In the past these have been fun opportunities to meet up
>     with other committers and contributors and to brainstorm  future
>     ideas as well as work together on bug fixes and new features.  If
>     enough people think it’s worth it I can try and set something up.
>
>     - Alan
>     ---------------------------------------------------------------------
>     To unsubscribe, e-mail: [email protected]
>     For additional commands, e-mail: [email protected]
>
-- 
Uwe Schindler
Achterdiek 19, D-28357 Bremen
https://www.thetaphi.de
eMail:[email protected]