You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Help in triaging node.js core security issues #598
The security triage team has nothing to do with the @nodejs/security-wg. It is the purvue of the TSC as part of the @nodejs/security team management. Generally speaking, all we need for this is no objections from @nodejs/tsc or @nodejs/security.
The security triage team has nothing to do with the @nodejs/security-wg. It is the purvue of the TSC as part of the @nodejs/security team management.
I just want to clarify this for those reading and thinking "Hey wait, isn't it Security WG's job to define this sort of policy?".
As it turns out, the charter for the group states among its responsibilities:
Review and recommend processes for handling of security reports (but not the actual administration of security reports, which are reviewed by a group of people directly delegated to by the TSC).
While this is vague, it effectively states that the core triage team consists of folks who are approved by the TSC directly. So yes, by the Security WG's own charter (and likely other bits of policy spread around the org), this repo (TSC) is the correct place for this discussion, and the Security WG has no other policy for this (nor is it chartered to do so).
Not sure if it was necessary but it seemed to be approved in a perfunctory fashion in today's TSC meeting, so I'm going to remove the tsc-agenda label.
@mcollina you should have received an email invite on the address from tje Node.js readme. Let me know if you want/need an onboarding, I'll be happy to schedule a call with you.
Activity
jasnell commentedon Sep 10, 2018
+1
Trott commentedon Sep 10, 2018
Is there a documented process for this? Is this the right repo etc.? @nodejs/security-wg
mcollina commentedon Sep 10, 2018
There isn't one. There is one for the 3rd-party vuln database (https://github.com/nodejs/security-wg/blob/master/processes/security_team_onboarding.md).
I think this is governed by the TSC and not by the security-wg.
jasnell commentedon Sep 10, 2018
The security triage team has nothing to do with the @nodejs/security-wg. It is the purvue of the TSC as part of the @nodejs/security team management. Generally speaking, all we need for this is no objections from @nodejs/tsc or @nodejs/security.
bengl commentedon Sep 10, 2018
@mcollina
@jasnell
I just want to clarify this for those reading and thinking "Hey wait, isn't it Security WG's job to define this sort of policy?".
As it turns out, the charter for the group states among its responsibilities:
While this is vague, it effectively states that the core triage team consists of folks who are approved by the TSC directly. So yes, by the Security WG's own charter (and likely other bits of policy spread around the org), this repo (TSC) is the correct place for this discussion, and the Security WG has no other policy for this (nor is it chartered to do so).
mhdawson commentedon Sep 10, 2018
+1
MylesBorins commentedon Sep 11, 2018
Trott commentedon Sep 11, 2018
I pinged Security WG because they often document our policies around this stuff because we fail to do so, not because I thought they had authority.
To wit: https://github.com/nodejs/security-wg/blob/master/processes/security_team_members.md#nodejs-security-team
mcollina commentedon Sep 12, 2018
@Trott there is absolutely no policy around that team, apart from being a TSC responsibility.
Trott commentedon Sep 19, 2018
Not sure if it was necessary but it seemed to be approved in a perfunctory fashion in today's TSC meeting, so I'm going to remove the
tsc-agendalabel.mcollina commentedon Sep 19, 2018
Cool! How do I get onboarded?
vdeturckheim commentedon Sep 19, 2018
@mcollina If I get TSC approval, I can invite you on HackerOne org and we can schedule a call so I show you around :)
cjihrig commentedon Sep 19, 2018
We talked about it in the private section of today's TSC meeting. @mcollina should be good to go I think.
vdeturckheim commentedon Sep 19, 2018
@mcollina you should have received an email invite on the address from tje Node.js readme. Let me know if you want/need an onboarding, I'll be happy to schedule a call with you.
mcollina commentedon Sep 19, 2018
A call will be good, how about tomorrow or Friday, maybe in the morning?
vdeturckheim commentedon Sep 19, 2018
Following up by email :)
mhdawson commentedon Oct 31, 2018
@mcollina I think this could be closed now.