Charter Security WG #548

vdeturckheim · 2018-06-01T14:33:12Z

This PR adds the Security WG as a chartered WG.
This probably can't be merged until nodejs/security-wg#295 is merged.

After this, is there anything else I should to to have this validated?

vsemozhetbyt · 2018-06-02T08:15:33Z

WORKING_GROUPS.md

+* Define and maintain security policies and procedures for:
+  * the core Node.js project
+  * other projects maintained by the Node.js Foundation technical group
+* Work with the node security project to bring community vulnerability data into


node -> Node.js?

Perhaps unfortunately (but perhaps not), the Node Security Platform styles it Node and not Node.js. See https://medium.com/npm-inc/npm-acquires-lift-security-258e257ef639.

Although I think we still need a change: node security project -> Node Security Platform (assuming I'm right about this referring to Node Security Platform).

vsemozhetbyt · 2018-06-02T08:21:59Z

WORKING_GROUPS.md

+  directly delegated to by the TSC).
+* Define and maintain policies and procedures for the coordination of security
+  concerns within the external Node.js open source ecosystem.
+* Offer help to npm package maintainers to fix high-impact security bugs


Missing period?

vsemozhetbyt · 2018-06-02T08:23:23Z

WORKING_GROUPS.md

+  * the core Node.js project
+  * other projects maintained by the Node.js Foundation technical group
+  * the external Node.js open source ecosystem
+* Promote improvement of security practices within the Node.js ecosystem


Missing period?

vsemozhetbyt · 2018-06-02T08:23:27Z

WORKING_GROUPS.md

+  * other projects maintained by the Node.js Foundation technical group
+  * the external Node.js open source ecosystem
+* Promote improvement of security practices within the Node.js ecosystem
+* Recommend security improvements for the core Node.js project


Missing period?

vsemozhetbyt · 2018-06-02T08:26:42Z

It seems this TOC also needs updating:
https://github.com/nodejs/TSC/blob/master/WORKING_GROUPS.md#current-working-groups

mcollina

LGTM

WaleedAshraf

Great job @vdeturckheim 👍
Can you also add a link to this section at the line in the reference above. #line247

WaleedAshraf · 2018-06-02T20:45:21Z

WORKING_GROUPS.md

+  the foundation as a shared asset.
+* Set up processes and procedures and follow these to ensure the vulnerability
+  data is updated in an efficient and timely manner. For example, ensuring there
+  are well documented processes for reporting vulnerabilities in community


well documented -> well-documented

WaleedAshraf · 2018-06-02T20:47:19Z

WORKING_GROUPS.md

+  include penetration testing, security reviews etc, review guidelines, coding
+  standards etc.
+* Review and recommend processes for handling of security reports (but not the
+  actual handling of security reports, which are reviewed by a group of people


nit: Maybe it's more clear to change handling -> administration ? Maybe not. 👍

WaleedAshraf · 2018-06-02T20:48:47Z

WORKING_GROUPS.md

+  modules.
+* Work to set a high standard for the Node.js project. Possibly efforts could
+  include penetration testing, security reviews etc, review guidelines, coding
+  standards etc.


Missing Comma standards etc. -> standards, etc.

WaleedAshraf · 2018-06-02T20:50:12Z

WORKING_GROUPS.md

+  are well documented processes for reporting vulnerabilities in community
+  modules.
+* Work to set a high standard for the Node.js project. Possibly efforts could
+  include penetration testing, security reviews etc, review guidelines, coding


Remove multiple etc.
security reviews etc -> security reviews

WaleedAshraf · 2018-06-02T20:51:08Z

WORKING_GROUPS.md

+  * the core Node.js project
+  * other projects maintained by the Node.js Foundation technical group
+  * the external Node.js open source ecosystem
+* Promote improvement of security practices within the Node.js ecosystem


Promote improvement -> Promote the improvement

vdeturckheim · 2018-06-04T19:41:35Z

Thanks for the reviews. I updated the doc.

WaleedAshraf

LGTM

mhdawson

LGTM

mhdawson · 2018-06-06T19:27:02Z

@nodejs/tsc it would be good to get more approvals. Unless we get objections I'd plan to land 1 week from today.

cjihrig · 2018-06-06T19:33:03Z

WORKING_GROUPS.md


+### [Security](https://github.com/nodejs/security-wg)
+
+The Security Working Group manages all aspects and process linked to security for Node.js.


process -> processes

... and maybe...

security for Node.js -> Node.js security

cjihrig · 2018-06-06T19:36:17Z

WORKING_GROUPS.md

+  * other projects maintained by the Node.js Foundation technical group
+* Work with the Node Security Platform to bring community vulnerability data into
+  the foundation as a shared asset.
+* Set up processes and procedures and follow these to ensure the vulnerability


I think most of this first sentence could be dropped and start with "Ensure that the..."

cjihrig · 2018-06-06T19:37:59Z

WORKING_GROUPS.md

+  data is updated in an efficient and timely manner. For example, ensuring there
+  are well-documented processes for reporting vulnerabilities in community
+  modules.
+* Work to set a high standard for the Node.js project. Possibly efforts could


I'd drop this bullet point.

thefourtheye · 2018-06-12T13:25:47Z

WORKING_GROUPS.md

+Responsibilities include:
+* Define and maintain security policies and procedures for:
+  * the core Node.js project
+  * other projects maintained by the Node.js Foundation technical group


"Node.js Foundation technical group" - Does this mean TSC?

thefourtheye · 2018-06-12T13:30:16Z

WORKING_GROUPS.md

+* Promote the improvement of security practices within the Node.js ecosystem.
+* Recommend security improvements for the core Node.js project.
+* Facilitate and promote the expansion of a healthy security service and product
+  provider ecosystem vulnerabilities.


I couldn't wrap my head around this point. It makes sense without the 'vulnerabilities' at the end though.

mhdawson · 2018-06-20T13:50:21Z

Going to land as I believe I updated to address the remaining comments. @thefourtheye if I've not addressed your comments adequately just let me know and I'll open a PR to further refine.

PR-URL: #548 Reviewed-By: Matteo Collina <[email protected]> Reviewed-By: Michael Dawson <[email protected]>

mhdawson · 2018-06-20T13:54:00Z

landed as b82207b

Trott · 2018-06-20T16:47:41Z

Website needs to be updated too at https://nodejs.org/en/about/working-groups/ if there's not already a PR for that. @nodejs/website

By the way, while adding stuff to that page, it might not be a terrible idea to take the time to alphabetize the list of working groups. It seems to be unordered.

mhdawson · 2018-06-20T18:23:06Z

PR to add minutes to website nodejs/nodejs.org#1708 including alphabetization.

Refs: nodejs/TSC#548

Refs: nodejs/TSC#548 Refs: nodejs#368 Fixes: nodejs#365

Refs: nodejs/TSC#548 Refs: #368 Fixes: #365

Refs: nodejs/TSC#548 Refs: nodejs/security-wg#368 Fixes: nodejs/security-wg#365

Charter Security WG

be071ea

vsemozhetbyt reviewed Jun 2, 2018

View reviewed changes

mcollina approved these changes Jun 2, 2018

View reviewed changes

WaleedAshraf reviewed Jun 2, 2018

View reviewed changes

update charter

1055d16

WaleedAshraf approved these changes Jun 4, 2018

View reviewed changes

mhdawson approved these changes Jun 5, 2018

View reviewed changes

mhdawson mentioned this pull request Jun 6, 2018

Time to charter the security working group #486

Closed

cjihrig reviewed Jun 6, 2018

View reviewed changes

update charter

03f5554

thefourtheye reviewed Jun 12, 2018

View reviewed changes

squash: address comments

3568a09

mhdawson pushed a commit that referenced this pull request Jun 20, 2018

doc: Charter Security WG

b82207b

PR-URL: #548 Reviewed-By: Matteo Collina <[email protected]> Reviewed-By: Michael Dawson <[email protected]>

mhdawson closed this Jun 20, 2018

ChALkeR mentioned this pull request Aug 4, 2018

doc: WG is chartered nodejs/security-wg#365

Closed

ChALkeR added a commit to ChALkeR/security-wg that referenced this pull request Aug 6, 2018

doc: sync charter with the actually approved one

b20bde1

Refs: nodejs/TSC#548

ChALkeR added a commit to ChALkeR/security-wg that referenced this pull request Aug 6, 2018

doc: sync charter with the actually approved one

07cd6a4

Refs: nodejs/TSC#548

ChALkeR added a commit to ChALkeR/security-wg that referenced this pull request Aug 6, 2018

doc: sync charter with the actually approved one

dae0457

Refs: nodejs/TSC#548 Refs: nodejs#368 Fixes: nodejs#365

ChALkeR mentioned this pull request Aug 6, 2018

doc: sync charter with the actually approved one nodejs/security-wg#369

Merged

ChALkeR added a commit to ChALkeR/security-wg that referenced this pull request Aug 6, 2018

doc: sync charter with the actually approved one

b224cc3

Refs: nodejs/TSC#548 Refs: nodejs#368 Fixes: nodejs#365

bengl pushed a commit to nodejs/security-wg that referenced this pull request Aug 16, 2018

doc: sync charter with the actually approved one (#369)

05f549d

Refs: nodejs/TSC#548 Refs: #368 Fixes: #365

patrickm68 added a commit to patrickm68/security-wg-process that referenced this pull request Sep 14, 2023

doc: sync charter with the actually approved one (#369)

2b7f556

Refs: nodejs/TSC#548 Refs: nodejs/security-wg#368 Fixes: nodejs/security-wg#365

mattstern31 added a commit to mattstern31/security-wg-process that referenced this pull request Nov 11, 2023

doc: sync charter with the actually approved one (#369)

1a9dac5

Refs: nodejs/TSC#548 Refs: nodejs/security-wg#368 Fixes: nodejs/security-wg#365


		### [Security](https://github.com/nodejs/security-wg)

		The Security Working Group manages all aspects and process linked to security for Node.js.

Uh oh!

Charter Security WG #548

Charter Security WG #548

Uh oh!

Conversation

vdeturckheim commented Jun 1, 2018

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

vsemozhetbyt commented Jun 2, 2018

Uh oh!

mcollina left a comment

Choose a reason for hiding this comment

Uh oh!

WaleedAshraf left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

vdeturckheim commented Jun 4, 2018

Uh oh!

WaleedAshraf left a comment

Choose a reason for hiding this comment

Uh oh!

mhdawson left a comment

Choose a reason for hiding this comment

Uh oh!

mhdawson commented Jun 6, 2018

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mhdawson commented Jun 20, 2018

Uh oh!

mhdawson commented Jun 20, 2018

Uh oh!

Trott commented Jun 20, 2018

Uh oh!

mhdawson commented Jun 20, 2018

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants