3 optimizations (especially eliminating double-calculation of traffic distance between traffic cache and audible alerts)#4
Merged
Conversation
… (made static final), based on CPU flamechart results
…g LatLong library) for doing fast distance calculation, when speed is more important than (still imperfect) accuracy
…y once--in traffic cache, using fast Haversine calculation (provided by existing LatLong library)
…ls, rather scheduling on a min delay interval, to prevent useless thrashing of the alert checker loop
apps4av
reviewed
Mar 29, 2024
apps4av
approved these changes
Mar 29, 2024
…string interpolation performance hit shown in flame chart
…tring interpolation hit showing up in the flamechart
…ust--or as robust as it can be without language synchronization primitives (e.g., monitors)
Contributor
Author
|
Zubair, I was wrong, there were no merge conflicts even after you merged in the other PR--Git never ceases to amaze me with how well is does these things! So you can merge this whenever you feel comfortable, @apps4av, as there is no need for me to rebase and resolve conflicts (there are none, from what I see and what Github is saying here). |
apps4av
added a commit
that referenced
this pull request
May 26, 2026
Fixes the security audit findings on the v1 Community rules. All changes are rules-only except a small members-screen tweak so that non-members of private groups see a friendly message instead of a raw permission-denied error. Critical / high: - Counter updates now require an exact +/-1 delta and forbid negative values, instead of allowing any signed-in user to set memberCount and postCount to arbitrary numbers (audit #1). Long-term fix is a Cloud Function trigger; documented in the rules file. - All user-writable documents (profile, group, member, post, userGroups index) are now whitelisted on field keys and validated on types, lengths, and enum values, closing latent privilege escalation paths and DoS via oversized documents (audit #2, #4, #8, #12, #13). - Removed the unconstrained isGroupOwner(gid) branch on member create. Owner approvals now flow through update of an existing pending doc, with status pinned to pending -> active and role/joinedAt frozen (audit #3). Medium: - Member rosters are no longer enumerable by strangers. Reads of groups/{gid}/members require self, owner, public visibility, or active membership (audit #6). - Posts are now bounded to 1000 characters at the rule level (audit #7) and to a fixed field whitelist (audit #8). Hardening: - isActiveMember consolidated to a single get() lookup pattern via helper functions (audit #10 partial). - All timestamps validated as `is timestamp`; full server-timestamp enforcement deferred to a future Cloud Function (audit #13). Knowingly not fixed in v1 (documented inline): - Group metadata visibility: the group doc remains readable by any signed-in pilot so the Discover tab can surface private groups by name. Sensitive future fields must live in a separate restricted subcollection (audit #5). - Counter drift under adversarial use: ruled-bounded to +/-1 per call; long-term fix requires Cloud Functions (audit #11). - Owners can technically self-delete their membership through this rule; rules cannot distinguish "owner leaves" from "owner deletes group". The client repository blocks owner-leave at call time (audit #9). Co-authored-by: Cursor <cursoragent@cursor.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Doing some inspection and CPU flame chart analysis of AvareX while traffic was on, I found 3 opportunities for optimization, which are addressed with this PR (the third of which doesn't deal with traffic per se, but it was something I noticed in the chart while looking at the others):
I can provide some screenshots (say of the before/after flamecharts) and screencast demo's if required; let me know. They did have a demonstrable impact when I ran them on my device (my screaming G16 laptop with the RTX 3070 Ti didn't care, of course, but that isn't what I will be flying with :-)