docs: a security policy and a changelog - #70
Merged
Merged
Conversation
Two gaps a 1.0 with a compatibility promise should not ship with. SECURITY.md exists mostly to say what is NOT a vulnerability. Aria has no sandbox and is not meant to: a program reads and writes any path the process can, and import reaches anywhere it is pointed. Someone will eventually report file access as a security hole, and the useful answer is a paragraph written before the report rather than after it. What is worth reporting is the other half: a Go panic, a hang in the scanner or parser, unbounded memory while merely reading a program, or an archive that does not match its source. Private advisories are the channel, and the note is honest that this is one person's toy language with no response-time commitment. CHANGELOG.md because docs/compatibility.md already promises that deprecations are announced "in both sets of release notes", and the release workflow generates notes with --generate-notes, which is a list of pull request titles. That is fine for a patch and not enough for a major, where the question a reader has is "what breaks". So the 1.0.0 entry keeps a Breaking section separate from the rest, covering the eleven changes since 0.6.0 that can stop an existing program: integer overflow, ordering on collections, atom keying, case lists, empty bodies, Record, aliased imports, String.first, stray control keywords, and the CLI exit status. Both are linked from the README's header note, along with the two docs that were already there. One correction while writing it: the changelog first said `go install` resolved to a 2017 pseudo-version "until 1.0.0". It was v0.6.0 that fixed that, being the first tag with a `v` on it. No em dashes in either, or in compatibility.md, which had three. That is the README's convention and these are read the same way. architecture.md and CLAUDE.md keep theirs; they are notes for whoever works on the interpreter and were written that way on purpose. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two gaps a 1.0 with a compatibility promise should not ship with.
What changed
SECURITY.mdexists mostly to say what is not a vulnerability. Aria has no sandbox and is not meant to: a program reads and writes any path the process can, andimportreaches anywhere it is pointed. Someone will eventually report file access as a security hole, and the useful answer is a paragraph written before the report rather than after it. The other half says what is worth reporting — a Go panic, a hang in the scanner or parser, unbounded memory while merely reading a program, an archive that does not match its source — and points at private advisories. It is honest that this is one person's toy language with no response-time commitment.CHANGELOG.mdbecausedocs/compatibility.mdalready promises deprecations are announced "in both sets of release notes", and the release workflow uses--generate-notes, which is a list of PR titles. Fine for a patch, not enough for a major, where the reader's question is "what breaks". The 1.0.0 entry keeps a Breaking section separate, covering the eleven changes since 0.6.0 that can stop an existing program.Both are linked from the README's header note, alongside the two docs already there.
One correction while writing it: the changelog first said
go installresolved to a 2017 pseudo-version "until 1.0.0". It wasv0.6.0that fixed that, being the first tag with avon it.No em dashes in either, or in
compatibility.md, which had three. That is the README's convention and these are read the same way.architecture.mdandCLAUDE.mdkeep theirs, being notes for whoever works on the interpreter.