Formation of a Security Working Group

[sam-github]

There was a meeting at the collab summit after NINA16 in Austin to discuss forming of a Security Working Group.

A number of people are interested, there seems to be work to do.

See nodejs/security-wg#9 for initial project boiler plate, and nodejs/security-wg#10 for the WIP PR for meeting minutes.

What is the process for forming this working group?

What is the process for naming it, as well? See discussion in nodejs/security-wg#9

[williamkapke]

@sam-github I want to discuss nodejs/security-wg#11 (which relates to nodejs/security-wg#9) at the next TSC meeting so I've added the tsc-agenda label.

To me, it seems like the Board has handed us a new Top-Level Project... not a Working Group. If this is true, then a Technical Committee needs to be formed instead.

To answer your question though- you can review: https://github.com/nodejs/TSC/blob/master/WORKING_GROUPS.md#starting-a-wg

[mikeal]

We just discussed this a bit in the CTC meeting. @sam-github if you like I'd love to chat I can fill you in a lot of the back story.

A few updates:

• The TSC would like a recommendation from the participants on how they would like it structured.
• My recommendation, and I believe Rod's as well, is for this to be a Top Level Working Group, but ultimately we want to hear from the people doing the work how they would like to be organized.
• In addition, I would recommend a WG over a TLP as a starting point and only migrate to a TLP once the WG needs the additional structure to manage the work.

[jasnell]

This effort has been underway and is making progress.

[joshgav]

Related: nodejs/security-wg#11

[jasnell]

@sam-github ... can you provide an update on where things are at on this? Does this issue need to remain open?

[sam-github]

There are a group of people meeting semi-regularly, but I don't think we are officially incorporated (?) as a Working Group, or if we have to be. @williamkapke or someone more familiar with the process might have better feedback.

I think the people in the meeting are happy with the status, I don't know if the CTC/TSC/whoever is responsible wants it to be more official.

[jasnell]

The choice of whether it needs to be more official is largely up to what the security team is looking to accomplish. If you're able to get the stuff done that you feel you need to get done, without an official charter, then awesome, that just makes the job easier for everyone. If you feel a charter is necessary, then that is something you can work out amongst yourselves then open a PR with the Charter. You will need to decide if you want that to be chartered under the CTC or TSC -- which depends entirely on the scope of what you're looking to accomplish.

For the time being, let's close this specific issue. If the security team wishes to charter, then a PR with the draft charter should be opened.