security: narrow down the scope of what we consider a vulnerability#18752
Conversation
|
THANKS ! |
ServeurpersoCom
left a comment
ServeurpersoCom
left a comment
There was a problem hiding this comment.
LGTM. Clear scope, PoC requirement, and AI restrictions will improve signal-to-noise ratio on security reports.
| - `src/**/*` | ||
| - `ggml/**/*` | ||
| - `gguf-py/**/*` | ||
| - `tools/server/*` (note: Web UI is not covered) |
There was a problem hiding this comment.
I want to make this a bit more clear, will push a new PR for that. Btw forgot to tell you @ServeurpersoCom but we should wait for @ggerganov approval too (I guess it's fine this time, no worries)
(to Georgi: if you need any modifications, fell free to comment on my next PR)
There was a problem hiding this comment.
We get many reports about DoS (Denial-of-Service) where certain input crashes the server for example - I don't think these vulnerabilities are significant for the project at this stage, so we should add a separate point to treat these as bugs instead of vulnerabilities.
There was a problem hiding this comment.
Absolutely, even if some DoS attacks have the potential to escalate, if they are fixed beforehand it poses no problem
…gml-org#18752) * security: narrow down the scope of what we consider a vulnerability * fix typo
…gml-org#18752) * security: narrow down the scope of what we consider a vulnerability * fix typo
3 participants
Changes in this PR:
examples/**) will be considered as general bugs