veg/tmux-party
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

docs: state the accidents-not-adversaries threat model; add ROADMAP

Browse source 
The gates in front of destructive operations exist to stop mistakes
(stale rosters, typos, racing hosts); stopping a malicious group
member is a side effect, not the design goal. Written into README
§Security and the man page so future checks are judged by that bar.
ROADMAP.md captures the direction: social features (knock, log,
clean) over further hardening, plus the explicit resist list.
This commit is contained in:
veg 2026-07-04 14:41:43 +00:00
parent 938491df1e
commit ff92d812ad
3 changed files with 63 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

10
party.1
View file

@ -356,6 +356,16 @@ A group member who plants a forged directory cannot fake its
ownership, cannot redirect the socket path, and cannot forge a socket
elsewhere.
.Pp
The threat model is accidents, not adversaries.
The ownership and symlink gates in front of destructive operations
exist so a stale roster, a typo, or two racing
.Cm host
invocations cannot remove or hijack the wrong directory; that they
would also stop a malicious group member is a side effect, not the
design goal.
New checks should prevent a plausible mistake, not a hypothetical
attack from a friend.
.Pp
.Nm
is designed for small, mutually trusted groups: a hacklab, a tech
team, a circle of friends, not strangers across the internet.