You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@geaflow.apache.org by "ppkarwasz (via GitHub)" <gi...@apache.org> on 2026/08/04 20:22:34 UTC
[PR] docs: add a draft threat model for GeaFlow [geaflow-website]
ppkarwasz opened a new pull request, #25:
URL: https://github.com/apache/geaflow-website/pull/25
Adds `community/en/threat-model.md`, a **draft** threat model for GeaFlow. It renders
at `/community/threat-model`; the community sidebar is autogenerated, so no config
change was needed.
## Why
GeaFlow currently has no security model on the record anywhere. `SECURITY.md` is
purely disclosure process, `community/en/security.md` and `community/zh/security.md`
are empty stubs, and the project is not listed at
[security.apache.org/projects](https://security.apache.org/projects/). The practical
cost is that a triager handed a vulnerability report has nothing to cite, and an
integrator has no way to tell which threats GeaFlow has taken on and which are left
to them.
This is the follow-up promised in apache/geaflow#828, which routes reports to
`security@apache.org`. That triage only pays off once the project has written down
what it considers in scope, so the ASF Security Team can close out-of-model reports
without involving the PPMC every time.
## How it was produced
Against the ASF Security team's `threat-model-producer` rubric
(<https://gist.github.com/potiuk/da14a826283038ddfe38cc9fe6310573>). Per that rubric
this is a statement of the project's *contract*, not an audit: no CVE-style findings,
no code-level defects, no build or release hygiene.
It models two component families, the **engine** and the **console**, and explicitly
places the Kubernetes operator, `geaflow-mcp`, `geaflow-ai`, the examples and the
all-in-one demo images out of model.
## This is a draft, and roughly half of it is guesswork
**20 claims are documented, 0 come from a maintainer, and 30 are inferred** from code
structure or the absence of a feature. Every inferred claim is tagged as such and
routed to one of the 14 open questions in §14. Nothing here is PPMC policy until you
answer them.
The single most important question is §14 Q1, because most of the document depends
on it:
> **Is the cluster network a trust boundary?** The draft proposes *no*: that GeaFlow
> assumes its engine ports (analytics, dashboard, agent, RPC, shuffle) sit on a
> network reachable only by the operator and the cluster, in the same way Apache Spark
> and Apache Flink assume it of theirs.
If that is right, a report of "endpoint X is unauthenticated" becomes
`OUT-OF-MODEL: adversary-not-in-scope` and the obligation moves to the operator
responsibilities in §10. If it is wrong, several sections need rewriting. I have
proposed an answer to every question rather than just asking, so you can confirm,
correct or strike each one rather than compose from scratch.
Answering wave 1 (Q1 to Q5) resolves most of the document.
Please do read §9 (properties the project does *not* provide) and §11a (proposed
recurring non-findings) with particular care. §11a is deliberately marked provisional
and must not be used as a suppression list until ratified, because several of its
entries are only correct if Q1 is answered as proposed.
## Deliberately not in this PR
- **The Chinese translation.** `community/zh/` mirrors every English page. Machine
translating an unratified security document seemed worse than not translating it, so
the zh side is untouched. Happy to add it once the content settles, if someone can
review the translation.
- **Filling in `security.md`.** The website's security page is an empty stub and should
probably mirror `SECURITY.md`, with a link to this document, but that is a separate
change and a separate decision.
## Review notes
Every configuration key, default and behaviour cited was checked against
`apache/geaflow` at commit `958b8039`, which is what §1 binds the model to. Corrections
to any of them are very welcome; the document is only useful if it is accurate.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@geaflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@geaflow.apache.org
For additional commands, e-mail: issues-help@geaflow.apache.org
Re: [PR] docs: add a draft threat model for GeaFlow [geaflow-website]
Posted by "Loognqiang (via GitHub)" <gi...@apache.org>.
Loognqiang merged PR #25:
URL: https://github.com/apache/geaflow-website/pull/25
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@geaflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@geaflow.apache.org
For additional commands, e-mail: issues-help@geaflow.apache.org
Re: [PR] docs: add a draft threat model for GeaFlow [geaflow-website]
Posted by "ppkarwasz (via GitHub)" <gi...@apache.org>.
ppkarwasz commented on PR #25:
URL: https://github.com/apache/geaflow-website/pull/25#issuecomment-5368519680
Hi @Loognqiang,
I'll ask Claude to fold in @oscerd's comments into the model.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@geaflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@geaflow.apache.org
For additional commands, e-mail: issues-help@geaflow.apache.org