Initial project boilerplate and README #9

sam-github · 2016-12-12T21:04:40Z

No description provided.

williamkapke · 2016-12-12T21:15:27Z

Please do not merge this until the Charter is approved.
..OR put a large notice in the README stating that the group is seeking Charter by the TSC as of XXX date.

sam-github · 2016-12-12T21:34:58Z

@williamkapke Done, I was a bit literal with the XXX date, because I don't know what date that is supposed to be.

Do you have a ref to charter approval process? I thought the TSC had requested the group be formed.

Any suggestions you have for following the formal process would be welcome.

Trott · 2016-12-12T22:13:28Z

README.md

@@ -1,9 +1,27 @@
-# Node.js Security Working Group
+# Security Work Group


Nit: Working Group is what all the other WGs are listed as, so should probably keep that consistent here.

Trott · 2016-12-12T22:14:54Z

Still not a fan of the name. There's already a security team that can be @-mentioned as nodejs/security. This is bound to be a cause of tons of confusion. I'd prefer Security Policy Working Group or something like that. But it's not my working group to name. Just chucking in my two cents...

mhdawson

LGTM with change of name to "Security Policy Working Group"

sam-github · 2016-12-13T17:36:22Z

@williamkapke or anyone... what is the process for incorporating a working group? I assume that process would allow some discussion of the name.

I agree, "Security Working Group" as a name is confusing because there is already a security team/email address, but I don't like the "Policy" variant either, because some of the things discussed that the WG could do are not policy related.

I think the security team should be renamed, since its purpose is narrow enough to easily name, and its camping on a generic term. It would make sense to call it the vulnerability response team or something of the like, and then this WG/team could be the Security WG without confusion.

williamkapke · 2016-12-13T18:11:38Z

For others that come along- check out: nodejs/TSC#175 (comment)

In short- I think we might be talking about a "Node.js Security Top-Level Project" and a "Security Technical Committee" instead.

sam-github · 2016-12-13T18:59:23Z

Merged all content from #1

sam-github · 2016-12-13T19:09:55Z

As far as mandate goes, and following on from #1, I think the README shouldn't be as specific as it is.

The mandate is specifically to be custodian of node security related work, and generally to improve security of Node.js and its ecosystem. We could leave it at that (but better worded).

Specific things we could do can be brought up as issues, discussed on github or in WG meetings, and then added to the README as necessary and useful, or just left in the issues and meeting notes if that's all that is required.

This would allow discussion of, for example, how we could contribute to ecosystem security without attempting to get involved in thirdparty project's security without being invited.

mhdawson · 2016-12-13T22:27:54Z

I think giving people an idea of what we think is currently in scope is not a bad thing. The Mandate can also change so its not like its we can't change our minds later. But given that the group has not yet met to discuss either waiting to land until some discussion takes place could make sense or making it less specific would be ok. However, being as specific as is useful once there has been discussion seems best to me.

sam-github · 2017-01-12T20:48:06Z

PTAL I need one more LGTM

I added everyone from the repository @nodejs/security-wg team to the README as team members, since you have all accepted. If that isn't correct, please tell me.

sam-github · 2017-01-13T23:24:29Z

@williamkapke does the README address #9 (comment) ? LGTY?

digitalinfinity · 2017-01-14T00:47:19Z

I'm not as expert on Node process as @williamkapke is, but to my untrained eye, the contents of this PR looks fine, so LGTM from me.

mcollina

LGTM

williamkapke

A few nits - but otherwise looking good!

williamkapke · 2017-01-14T17:35:07Z

CONTRIBUTING.md

+
+
+Code of Conduct
+


Many repos just add a pointer to the main copy of the CoC:
https://github.com/nodejs/node/blob/master/CODE_OF_CONDUCT.md

ref: nodejs/community-committee#7

williamkapke · 2017-01-14T17:42:27Z

LICENCE.md

@@ -4,8 +4,19 @@ The MIT License (MIT)
 Copyright (c) 2016 Node.js Foundation


This could be bumped to 2017 now...

ref: nodejs/TSC#195

sam-github · 2017-01-17T21:13:06Z

@williamkapke PTAL

gibfahn · 2017-01-18T08:16:29Z

GOVERNANCE.md

+There is no specific set of requirements or qualifications for WG membership
+beyond these rules.
+
+The WG may add additional members to the WG by unanimous consensus.


Could you include a link to the @nodejs/ team that comprises the members?

Also will there be a team for Collaborators? I assume @nodejs/security-wg is the members.

There is no link that is viewable, except by members, teams are private. Also, did you notice I listed all the members in the README?

There is no distinction between member and Collaborator in any of the WGs that I am aware of.

@sam-github I agree that I've never heard of a collaborator/member distinction before, which is why I found this confusing:

The security GitHub repository is maintained by the WG and additional Collaborators who are added by the WG on an ongoing basis. Individuals making significant and valuable contributions are made Collaborators and given commit-access to the project.

This implies that the members (the WG) are a subsection of Collaborators, otherwise why have one paragraph called Collaborators and one paragraph called Members?

I noticed that you listed the Collaborators in the README, which is why I asked about the members.

The link is viewable by members of the nodejs org, so by writing @nodejs/security-wg (and possibly linking to https://github.com/orgs/nodejs/teams/security-wg) you make it clear which team corresponds to the members/collaborators list.

The GOVERNANCE of the security-wg is identical to https://github.com/nodejs/benchmarking/blob/master/GOVERNANCE.md, I don't want to have customized governance policy per working group. The governance documents and policies should all, ultimately, be centralized so that they can be referenced by link. Lets not diverge. Its already odd that some WGs have a governance, and others don't (https://github.com/nodejs/build). I'm tempted to just delete this, it doesn't seem necessary.

It is on my TODO list to start a discussion about the need for a GOVERNANCE.md vs. just putting it in the README (which I'd prefer). There COULD be a reason... I just don't know it. I've just been shooting for consistency for now.

PR-URL: #9 Reviewed-By: Michael Dawson <[email protected]> Reviewed-By: Matteo Collina <[email protected]> Reviewed-By: Sam Roberts <[email protected]> Reviewed-By: Adam Brady <[email protected]>

PR-URL: nodejs/security-wg#9 Reviewed-By: Michael Dawson <[email protected]> Reviewed-By: Matteo Collina <[email protected]> Reviewed-By: Sam Roberts <[email protected]> Reviewed-By: Adam Brady <[email protected]>

sam-github mentioned this pull request Dec 12, 2016

doc: notes on purpose from WG meeting #8

Closed

Trott reviewed Dec 12, 2016

View reviewed changes

williamkapke mentioned this pull request Dec 12, 2016

What IS this security initiative? #11

Closed

mhdawson approved these changes Dec 12, 2016

View reviewed changes

mhdawson mentioned this pull request Dec 12, 2016

Security Working Group Purpose proposal #1

Closed

mcollina mentioned this pull request Dec 13, 2016

Working Group governance model & charter nodejs/readable-stream#248

Closed

gibfahn mentioned this pull request Dec 13, 2016

doc: document process for access to jenkins jobs nodejs/build#554

Closed

sam-github mentioned this pull request Dec 13, 2016

Formation of a Security Working Group nodejs/TSC#175

Closed

mcollina approved these changes Jan 14, 2017

View reviewed changes

SomeoneWeird approved these changes Jan 14, 2017

View reviewed changes

williamkapke suggested changes Jan 14, 2017

View reviewed changes

williamkapke approved these changes Jan 17, 2017

View reviewed changes

gibfahn reviewed Jan 18, 2017

View reviewed changes

sam-github added 2 commits January 18, 2017 12:47

Initial project boilerplate and README

09f2b73

PR-URL: #9 Reviewed-By: Michael Dawson <[email protected]> Reviewed-By: Matteo Collina <[email protected]> Reviewed-By: Sam Roberts <[email protected]> Reviewed-By: Adam Brady <[email protected]>

Update current project members

a5f5246

PR-URL: #9 Reviewed-By: Michael Dawson <[email protected]> Reviewed-By: Matteo Collina <[email protected]> Reviewed-By: Sam Roberts <[email protected]> Reviewed-By: Adam Brady <[email protected]>

sam-github merged commit a5f5246 into nodejs:master Jan 18, 2017

sam-github deleted the initial-boilerplat-and-readme branch October 12, 2017 21:11

mcollina mentioned this pull request Mar 12, 2018

License of the database #156

Closed

Trott mentioned this pull request Sep 24, 2019

doc: TSC has responsibility for Node.js security #579

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Initial project boilerplate and README #9

Initial project boilerplate and README #9

sam-github commented Dec 12, 2016

williamkapke commented Dec 12, 2016 •

edited

Loading

sam-github commented Dec 12, 2016

Trott Dec 12, 2016

Trott commented Dec 12, 2016

mhdawson left a comment

sam-github commented Dec 13, 2016

williamkapke commented Dec 13, 2016

sam-github commented Dec 13, 2016

sam-github commented Dec 13, 2016

mhdawson commented Dec 13, 2016

sam-github commented Jan 12, 2017

sam-github commented Jan 13, 2017

digitalinfinity commented Jan 14, 2017

mcollina left a comment

williamkapke left a comment

williamkapke Jan 14, 2017

williamkapke Jan 14, 2017

sam-github commented Jan 17, 2017

gibfahn Jan 18, 2017

sam-github Jan 18, 2017

gibfahn Jan 19, 2017

sam-github Jan 19, 2017

williamkapke Jan 19, 2017

		@@ -1,9 +1,27 @@
		# Node.js Security Working Group
		# Security Work Group

		@@ -4,8 +4,19 @@ The MIT License (MIT)
		Copyright (c) 2016 Node.js Foundation



		Code of Conduct

Initial project boilerplate and README #9

Initial project boilerplate and README #9

Conversation

sam-github commented Dec 12, 2016

williamkapke commented Dec 12, 2016 • edited Loading

sam-github commented Dec 12, 2016

Choose a reason for hiding this comment

Trott commented Dec 12, 2016

mhdawson left a comment

Choose a reason for hiding this comment

sam-github commented Dec 13, 2016

williamkapke commented Dec 13, 2016

sam-github commented Dec 13, 2016

sam-github commented Dec 13, 2016

mhdawson commented Dec 13, 2016

sam-github commented Jan 12, 2017

sam-github commented Jan 13, 2017

digitalinfinity commented Jan 14, 2017

mcollina left a comment

Choose a reason for hiding this comment

williamkapke left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sam-github commented Jan 17, 2017

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

williamkapke commented Dec 12, 2016 •

edited

Loading