vlsi commented on PR #5020: URL: https://github.com/apache/calcite/pull/5020#issuecomment-5034380228
I opened #5115 as an alternative draft for the same Jira. It reorganizes the same normative content (attacker model, P1–P4, the class-loading rule, DoS goals) rather than replacing it, and makes two structural changes I found easier to review as a whole diff than as inline comments here: - the concrete class-loading sinks move to a separate living document, so a new CVE updates that inventory and not the ratified model; - the STRIDE table and the ASCII diagram are dropped — the reasoning is in the PR description. This isn't meant to compete with your PR. Whichever framing the PMC prefers, I'm happy to fold the pieces back into #5020 instead. Interested in your take. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
