I'm also planning to attend CoC Glasgow and would love to join the hackathon, time/talks permitting!
A few more of us (from Amazon customer facing product search team, using Lucene to search all of Amazon's fast-changing catalog) are hoping/planning to come too... Mike McCandless http://blog.mikemccandless.com On Thu, Aug 20, 2026 at 5:36 AM Uwe Schindler via dev <[email protected]> wrote: > Hi, > > I will also be there. I'd like to discuss a bit about a SECURITY.md in our > repository and some ideas what we should treat as security vulnerability > and what not. Not only about idex files and possibly missing checks in > public APIs. Also with regards to XML queryparser, serialization and so on > - although those are mot of the cases security related and should be fixed. > > The reason why I am bringing that up: We recently got many - and rejected > security issues from people forcefully flipping specific bits and bytes in > a Lucene index file (and also fixing the checksum) and later said: "Theres > a DOS attack because of an infinite loop while reading that file." We all > know that we often cannot do checks at every possibly entry point and our > code trusts that the index/codec file format is sane. Of course we can > improve that, but only without affecting performance. Therefore I'd like to > mock up a SECUIRTY.md file for the Lucene repo where we clearly say that an > index file must be coming from a trusted location and unauthorized > modifications on index files should be prevented by the downstream > application (like Elasticsearch/Solr doing a full cryptographic handshake > when transferring files over the network). > > I'd like to discuss and maybe hack a bit. So your inviation is great! And > some (many) beers are important, too! > > Uwe > Am 19.08.2026 um 06:08 schrieb Sagar Upadhyay: > > Hello, > > I am also coming to CoC Glasgow for a talk and would be really interested > in this! > > ~ Sagar > > On Tue, Aug 18, 2026, 7:27 AM Alan Woodward <[email protected]> wrote: > >> Hi everyone, >> >> I’ve just signed up for CoC in Glasgow this October, and I see that there >> is already a proposal for a Solr hackathon on the Monday. Would anybody be >> interested in a parallel Lucene group as well? In the past these have been >> fun opportunities to meet up with other committers and contributors and to >> brainstorm future ideas as well as work together on bug fixes and new >> features. If enough people think it’s worth it I can try and set something >> up. >> >> - Alan >> --------------------------------------------------------------------- >> To unsubscribe, e-mail: [email protected] >> For additional commands, e-mail: [email protected] >> >> -- > Uwe SchindlerAchterdiek 19, D-28357 Bremen > <https://www.google.com/maps/search/Achterdiek+19,+D-28357+Bremen?entry=gmail&source=g>https://www.thetaphi.de > eMail: [email protected] > >
