{"action":"created","issue":{"url":"https://api.github.com/repos/uptane/uptane-standard/issues/11","repository_url":"https://api.github.com/repos/uptane/uptane-standard","labels_url":"https://api.github.com/repos/uptane/uptane-standard/issues/11/labels{/name}","comments_url":"https://api.github.com/repos/uptane/uptane-standard/issues/11/comments","events_url":"https://api.github.com/repos/uptane/uptane-standard/issues/11/events","html_url":"https://github.com/uptane/uptane-standard/issues/11","id":372546883,"node_id":"MDU6SXNzdWUzNzI1NDY4ODM=","number":11,"title":"Threat model","user":{"login":"OYTIS","id":1929183,"node_id":"MDQ6VXNlcjE5MjkxODM=","avatar_url":"https://avatars1.githubusercontent.com/u/1929183?v=4","gravatar_id":"","url":"https://api.github.com/users/OYTIS","html_url":"https://github.com/OYTIS","followers_url":"https://api.github.com/users/OYTIS/followers","following_url":"https://api.github.com/users/OYTIS/following{/other_user}","gists_url":"https://api.github.com/users/OYTIS/gists{/gist_id}","starred_url":"https://api.github.com/users/OYTIS/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/OYTIS/subscriptions","organizations_url":"https://api.github.com/users/OYTIS/orgs","repos_url":"https://api.github.com/users/OYTIS/repos","events_url":"https://api.github.com/users/OYTIS/events{/privacy}","received_events_url":"https://api.github.com/users/OYTIS/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2018-10-22T14:33:41Z","updated_at":"2018-10-25T13:02:09Z","closed_at":null,"author_association":"NONE","body":"How the community feels about the idea of first describing Uptane threat model and security guarantees before diving into the implementation requirements?\r\nI strongly feel that the standard needs it so that implementers can understand what are the security tradeoffs when adapting the standard to one's needs. On the other hand I'm not confident that I can write this document because by expertise in security is not that high.\r\nSome threat model is already described in the \"design overview\" google doc, my idea is here\r\n\r\n- To have it in the standard as soon as possible.\r\n- To apply it more systematically in the work on the standard, so that every requirement (e.g. having snapshot metadata for director repo) can be traced back to the specific threat/security guarantee.\r\n\r\nThanks,\r\nAnton Gerasimov\r\nEmbedded Software Developer at HERE Technologies"},"comment":{"url":"https://api.github.com/repos/uptane/uptane-standard/issues/comments/433041530","html_url":"https://github.com/uptane/uptane-standard/issues/11#issuecomment-433041530","issue_url":"https://api.github.com/repos/uptane/uptane-standard/issues/11","id":433041530,"node_id":"MDEyOklzc3VlQ29tbWVudDQzMzA0MTUzMA==","user":{"login":"tkfu","id":4501758,"node_id":"MDQ6VXNlcjQ1MDE3NTg=","avatar_url":"https://avatars3.githubusercontent.com/u/4501758?v=4","gravatar_id":"","url":"https://api.github.com/users/tkfu","html_url":"https://github.com/tkfu","followers_url":"https://api.github.com/users/tkfu/followers","following_url":"https://api.github.com/users/tkfu/following{/other_user}","gists_url":"https://api.github.com/users/tkfu/gists{/gist_id}","starred_url":"https://api.github.com/users/tkfu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tkfu/subscriptions","organizations_url":"https://api.github.com/users/tkfu/orgs","repos_url":"https://api.github.com/users/tkfu/repos","events_url":"https://api.github.com/users/tkfu/events{/privacy}","received_events_url":"https://api.github.com/users/tkfu/received_events","type":"User","site_admin":false},"created_at":"2018-10-25T13:02:09Z","updated_at":"2018-10-25T13:02:09Z","author_association":"MEMBER","body":"I've expanded the threat model chapter in commit 7829f81b1238d0bacb01df60cf42381c3cb5e5d6 in #10. I haven't done anything yet on security guarantees, though."}}
{"actor":{"display_login":"tkfu"}}