Security-wg: [POSTPONED TBA]Node.js Foundation Security WorkGroup Meeting 2019-05-20

[mhdawson]

Time

UTC Mon 20-May-2019 15:00 (03:00 PM):

| Timezone | Date/Time |
|---------------|-----------------------|
| US / Pacific | Mon 20-May-2019 08:00 (08:00 AM) |
| US / Mountain | Mon 20-May-2019 09:00 (09:00 AM) |
| US / Central | Mon 20-May-2019 10:00 (10:00 AM) |
| US / Eastern | Mon 20-May-2019 11:00 (11:00 AM) |
| London | Mon 20-May-2019 16:00 (04:00 PM) |
| Amsterdam | Mon 20-May-2019 17:00 (05:00 PM) |
| Moscow | Mon 20-May-2019 18:00 (06:00 PM) |
| Chennai | Mon 20-May-2019 20:30 (08:30 PM) |
| Hangzhou | Mon 20-May-2019 23:00 (11:00 PM) |
| Tokyo | Tue 21-May-2019 00:00 (12:00 AM) |
| Sydney | Tue 21-May-2019 01:00 (01:00 AM) |

Or in your local time:

• http://www.timeanddate.com/worldclock/fixedtime.html?msg=Node.js+Foundation+Security%20WorkGroup+Meeting+2019-05-20&iso=20190520T15
• or http://www.wolframalpha.com/input/?i=03PM+UTC%2C+May+20%2C+2019+in+local+time

Links

• Minutes Google Doc: https://docs.google.com/document/d/1pklHdZACgNSaFup2DZaL07tEd1RdqxU9393qn1ZijdQ/edit

Agenda

Extracted from security-wg-agenda labelled issues and pull requests from the nodejs org prior to the meeting.

nodejs/TSC

• Regular schedule for Security releases? #647

nodejs/security-wg

• docs(processes): bug bounty program #532
• What upper vulnerable version should be set in reports? #526
• HackerOne's managed services #516
• Reaching out to other projects of the OpenJS Foundation #511
• Attendance in the upcoming Collaborator Summit in May? #510
• Large-scale disclosure guidelines #505
• should there be security-wg presentation at nodeconf.eu? #504
• Eligiblity criteria for meeting bug bounties #503
• [ANN - APR 26th 2019] Migrating vulnerabilities database into its own repository #494

Invited

• Security wg team: @nodejs/security-wg

Observers/Guests

Notes

The agenda comes from issues labelled with security-wg-agenda across all of the repositories in the nodejs org. Please label any additional issues that should be on the agenda before the meeting starts.

Joining the meeting

• link for participants: https://zoom.us/j/405474359
• For those who just want to watch We stream our conference call straight to YouTube so anyone can listen to it live, it should start playing at https://www.youtube.com/c/nodejs+foundation/live when we turn it on. There's usually a short cat-herding time at the start of the meeting and then occasionally we have some quick private business to attend to before we can start recording & streaming. So be patient and it should show up.
• youtube admin page: https://www.youtube.com/my_live_events?filter=scheduled

[sam-github]

This one falls on a holiday for me (and perhaps Michael?), I might not be around a computer at this time.

[mhdawson]

I'm away at a conference so I won't be able to make it. @cjihrig would you be able to start the zoom/stream ?

[cjihrig]

As of now, I should be able to do it. I'll post here if that changes.

[lirantal]

Many items on the agenda here that I'd like to be on the call for but I'm on a flight at that time so can't make it.

[sam-github]

I won't make it, @lirantal won't make it, @mhdawson might make it (but its a holiday monday for us), I wonder if we could push this to the next week?

EDIT: sorry, I didn't notice for some reason, @mhdawson definitely won't make it.

[vdeturckheim]

It's easier for me tomorrow but I can probably arrange to be available next week.

[vdeturckheim]

Is anyone strongly against postponing to next week?

[lirantal]

I'm up for postponing but also next week is OWASP Global AppSec in Tel Aviv and I'll be on that too. Could we perhaps post-pone it to a later time in the day as well? So say same day next week but 3 hours later?

[vdeturckheim]

👍 for me

[cjihrig]

+1 to postponing.

[vdeturckheim]

Let's consider it as cancelled for today and posponed to next week then

[sam-github]

@mhdawson I don't know how to use the tooling to reschedule the event for this coming Monday in the calendar, could you do that?

[mhdawson]

If you have access to the calendar you just edit/move it.

I'm justing this so its probably too late. Postponing to day would probably not have worked too well either as it's a holiday in the US.

When do people want to reschedule for? The next meeting is scheduled for June 17th.

[lirantal]

Perhaps best to re-group on June 17th.

[mhdawson]

I think just waiting until the 17th might be best, particularly with many people traveling this week for the Collab summit.

[lirantal]

Superseded by https://github.com/nodejs/security-wg/issues/541