Security Review for Components

[danmoseley]

No description provided.

[danmoseley]

Let's synchronize with the service discovery reviews?

[danmoseley]

Particular consideration: 3rd party libraries and their SLA/ship dates.

[danmoseley]

@ReubenBond did threat modeling/review happen for service discovery? I don't see any issue for it, I can open one.

@mitchdenny I wonder whether we need one for app model as well. Below are their usual criteria --

• They're intending to make security guarantees; e.g, they use cryptography.
• They can reasonably be expected to process input which didn't originate from within the application or from a trusted config source. For example: "The typical use case for this component is that the app reads some incoming request header and then passes that header value to us to capture telemetry."
• The component itself makes an outbound connection or handles an incoming connection. Here, "connection" means anything reaching beyond the current process, encompassing network connections, LRPC, named pipes, and similar.
• The component deals with PII.
• The component utilizes serialization or implements a protocol parser.

examples if only for my own reference
https://github.com/dotnet/runtime/blob/main/src/libraries/System.Text.Json/docs/ThreatModel.md
and various aspnet ones internally from before they were openly posted.

[danmoseley]

let's pick this up right after preview, so we don't do the last minute thing.

cc for @GrabYourPitchforks so he sees any discussion here about boundaries/scoping.

[joperezr]

Waiting on sign-off @GrabYourPitchforks

[eerhardt]

The work this is tracking is now complete. Closing.