Skip to content

Nov 2 meeting minutes #65

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
vdeturckheim merged 4 commits into from
Nov 23, 2017
Merged

Nov 2 meeting minutes #65

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
049c2e5
Copy and paste minutes from meeting just finished
mgalexander Nov 2, 2017
81cd361
update to action taken per comment from @bengl
mgalexander Nov 2, 2017
3fa0860
Thank you @reedloden for correcting and educating. I hope I understan…
mgalexander Nov 3, 2017
ba8b8b7
address nits called out by @mhdawson - ty for the corrections.
mgalexander Nov 3, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
63 changes: 63 additions & 0 deletions meetings/2017-11-02.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,63 @@
# Security WG meeting 2017-11-02

GitHub issue: https://github.com/nodejs/security-wg/issues/63
Meeting video: https://youtu.be/UWKC1GTPAFo
Previous meeting: https://github.com/nodejs/security-wg/blob/master/meetings/2017-10-12.md


# Present

- Bryan English (@bengl)
- Sam Roberts (@sam-github)
- Vladimir de Turckheim (@vdeturckheim)
- Michael Alexander (@mgalexander)
- Michael Dawson (@mhdawson)
- Reed Loden (@reedloden)
- Colin Ihrig (@cjihrig)
- Arunesh Chandra (@aruneshchandra)-observer
- Hitesh Kanwathirtha (@digitalinfinity)-observer
- Adam Baldwin - late (@evilpacket)

# Review of last meeting


# New agenda

## HackerOne setup/demo

* @vdeturckheim gave us a walkthrough of what he has setup.
* Easy to invite people to collaborate on specific vulnerabilities


## Bug Bounty Program https://github.com/nodejs/security-wg/issues/49

* want to add bounties Node.js to list they provide bounties for.
* not a huge amount of money ($1500 at the top end)
* does provide some additional motivation for researchers to find/report
issues.
* There is no cost to the project (Internet bug bounty would provide for free)
* Only for security vulnerabilities, do they need to go through HackerOne.
* Needs to meet some minimum bar.
* Michael: should probably get HackerOne setup done first ?
* Michael Alexander volunteered to champion this on the Security-wg, like with an
end of year timeframe.

## Proposing an Early Disclosure Program https://github.com/nodejs/security-wg/issues/58

* One thing discussed was to get more input from the potential consumers
* Vladimir will put together and issue, twitter etc to try to gather that input.

## acknowledge privacy of info in private repos.https://github.com/nodejs/security-wg/issues/64

* general consensus that having document and having people acknowledge in issue 64 is good
enough

# Actions

* @vdeturckheim to set up meeting with Core triage team to handover HackerOne Organization (https://github.com/nodejs/security-wg/blob/master/processes/security_team_members.md#team-that-triages-security-reports-against-node-core)
* Discuss issue linked with potential confusion between 2 HackerOne orgs from security reporters
* @vdeturckheim to create email alias for 3rd party vulnerability report
* @vdeturckheim to open an issue to open an issue to collect inputs regarding early disclosure.
* @mgalexander prepare proposal for bug bounty
* @bengl agreed to PR security team membership policy