Re: Cassandra project status update 2022-10-13

2022-10-13 Thread Josh McKenzie
Awesome - was missing the link to CASSANDRA-17930. That's a good home to link these efforts to. Thanks! On Thu, Oct 13, 2022, at 1:21 PM, Derek Chen-Becker wrote: > Hi Josh, > > I do have a ticket for the CircleCI addition: > https://issues.apache.org/jira/browse/CASSANDRA-17950. It's a subtask

Re: Cassandra project status update 2022-10-13

2022-10-13 Thread Derek Chen-Becker
Hi Josh, I do have a ticket for the CircleCI addition: https://issues.apache.org/jira/browse/CASSANDRA-17950. It's a subtask of https://issues.apache.org/jira/browse/CASSANDRA-17930, which I'm planning on doing more work on once I get confirmation that I'm not doing something wrong with CircleCI :

Cassandra project status update 2022-10-13

2022-10-13 Thread Josh McKenzie
Late Post-ApacheCon update ftw! I'll probably give it 2.5 weeks before the next update so we have more time for things to settle and evolve as we run up to 4.1 rc and ga. First off - for all of you who couldn't make it to ApacheCon: you were missed. New Orleans was great (and the food there und

Re: [VOTE] Revising release gating criteria and CI systems

2022-10-13 Thread Josh McKenzie
With 8 +1's (and >= 3 binding), the vote passes. I'll get the documentation updated. Thanks everyone! On Tue, Oct 11, 2022, at 2:34 PM, Jeremiah D Jordan wrote: > +1 nb > >> On Oct 8, 2022, at 7:30 AM, Josh McKenzie wrote: >> >> DISCUSS thread: >> https://lists.apache.org/thread/o166v7nr9lxnz

Re: [Discuss] CEP-24 Password validation and generation

2022-10-13 Thread Claude Warren, Jr via dev
I am not familiar with the Diagnostics framework but it sounds like it would satisfy the need. Thanks for pointing it out. I will dive into it to get an understanding of how it works. On Thu, Oct 13, 2022 at 1:52 PM Miklosovic, Stefan < stefan.mikloso...@netapp.com> wrote: > Hi Claude, > > we m

Re: [Discuss] CEP-24 Password validation and generation

2022-10-13 Thread Miklosovic, Stefan
Hi Claude, we may also integrate with Diagnostics framework Cassandra already ships. I would say this better suits to your requirements for observability. I am not sure to what degree you are familiar with Diagnostics though. To give you a better picture, events are fired and external observers

Re: [Discuss] CEP-24 Password validation and generation

2022-10-13 Thread Claude Warren, Jr via dev
The only difference I see is that I see observability (observer) as being a way to retrieve (or be notified about) data used within a process. Logging on the other hand, is a preservation of a state discovered in an observable object. Observability can drive logging but it can also drive aggregat

Re: [Discuss] CEP-24 Password validation and generation

2022-10-13 Thread Claude Warren, Jr via dev
I think we might be in violent agreement here. The point I was trying to make is that the rules for valid passwords are many and varied. I have worked at places where they wanted to know the time since the last password change, this was used to prevent the rapid change of password to get back to

Re: [Discuss] CEP-24 Password validation and generation

2022-10-13 Thread Fleming, Jackson
I agree that the log sent back to the user is perhaps too verbose for an audit log, Jeff’s log format is nice in that regard, due to a clear pattern (nice for log parsers) with a clear distinct reason for failure that has enough details for an auditor to understand what happened, though it gets

Re: [Discuss] CEP-24 Password validation and generation

2022-10-13 Thread Miklosovic, Stefan
Hi Claude, you said: "I don't know the govt spec. but there is a US govt security level where you are not allowed to inform the user why the login failed." I do not think this is the case. Nobody is going to inform a user with existing role in the db why he failed to log in, when it comes to th

Fwd: [Discuss] CEP-24 Password validation and generation

2022-10-13 Thread Claude Warren, Jr via dev
I managed not to send this to the mailaing list... I don't know the govt spec. but there is a US govt security level where you are not allowed to inform the user why the login failed. It seems to me that there are 2 intertwined components being discussed. 1) A component to perform a user passw