docs(prd): add PRD 0008 — Notice what changed on the network, not everything on it - #57
Merged
Merged
Conversation
…rything on it Watching all traffic on all ports produces a firehose nobody reads; inbound scanning is background radiation on any public IP. The high-signal facts are about change. A NEW LISTENING PORT is the single most valuable network fact on a server — a process not accepting connections yesterday and accepting them today is either a deploy or a backdoor. Likewise a new outbound destination from a process that has never made one, and a listener whose owning binary changed. Separately, services bound to 0.0.0.0 that should be on loopback are how a large share of small-team data loss happens, and that is available instantly as posture. Designed to work from socket inventory rather than packet capture, so it can run unprivileged and degrade honestly where it cannot. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
vu1nz Security Review0 finding(s) in PR #? No security issues found. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Specification for the
network-monitorcore module, listed inPRD.mdand not yet specified.Watching all traffic on all ports produces a firehose nobody reads; inbound scanning is background radiation on any public IP.
The high-signal facts are about change. A NEW LISTENING PORT is the single most valuable network fact on a server — a process not accepting connections yesterday and accepting them today is either a deploy or a backdoor. Likewise a new outbound destination from a process that has never made one, and a listener whose owning binary changed. Separately, services bound to 0.0.0.0 that should be on loopback are how a large share of small-team data loss happens, and that is available instantly as posture.
Designed to work from socket inventory rather than packet capture, so it can run unprivileged and degrade honestly where it cannot.
Spec only — no implementation in this PR.