Blockables are created with a score of 0 and in the UNTRUSTED state.
| State | Default Score Threshold | Blockable Policy |
|---|---|---|
BANNED |
-15 | Globally blacklisted. |
SUSPECT |
N/A | (Downvoted by an elevated-privilege user.) Cannot be voted on until an elevated-privilege user upvotes it. |
UNTRUSTED |
0 | No policy set. |
APPROVED_FOR_LOCAL_WHITELISTING |
5 | Users who have upvoted it are granted local whitelist policies. |
GLOBALLY_WHITELISTED |
50 | Globally whitelisted. |
All voting weights are configurable via the VOTING_WEIGHTS setting but, by
default, normal users vote with weight 1. Escalated-privilege users are able to
are able to select among the vote weights their role permits.
When a user votes on a Blockable, a Vote entity is created and their vote
weight is added or subtracted from that Blockable's score depending on whether
they upvoted or downvoted the binary, respectively.
When a Blockable score crosses one of the score thresholds (configurable via
the VOTING_THRESHOLD setting), the Blockable moves into the state specified
by that threshold. State change can induce policy (in the form of Rule
entities) to be created, removed, or both depending on the nature of the change.
Rule entities may apply to a single Host or all Hosts:
- Local
Rules: non-empty host ID field that only applies the policy to the specified host. - Global
Rules: empty host ID field and their policy applies to all hosts in the fleet.
An example of a policy change would be when a Blockable reaches a score of 50
and transitions from the locally whitelisted to the globally whitelisted state.
In this case, all previous local Rules are removed (actually "deactivated")
and a single global whitelist Rule is created.
If any user downvotes a Blockable, voting on that Blockable stops until a privileged user has reviewed it and either upvoted it to unflag it or downvoted it to keep normal voting disabled.
Blockables can be "reset" meaning that all votes and rules are deactivated,
the Blockable score returns to 0, and the Blockable's state to UNTRUSTED.