Node.js Security WorkGroup Meeting 2022-12-22

[mhdawson]

Time

UTC Thu 22-Dec-2022 15:00 (03:00 PM):

Timezone	Date/Time
US / Pacific	Thu 22-Dec-2022 07:00 (07:00 AM)
US / Mountain	Thu 22-Dec-2022 08:00 (08:00 AM)
US / Central	Thu 22-Dec-2022 09:00 (09:00 AM)
US / Eastern	Thu 22-Dec-2022 10:00 (10:00 AM)
EU / Western	Thu 22-Dec-2022 15:00 (03:00 PM)
EU / Central	Thu 22-Dec-2022 16:00 (04:00 PM)
EU / Eastern	Thu 22-Dec-2022 17:00 (05:00 PM)
Moscow	Thu 22-Dec-2022 18:00 (06:00 PM)
Chennai	Thu 22-Dec-2022 20:30 (08:30 PM)
Hangzhou	Thu 22-Dec-2022 23:00 (11:00 PM)
Tokyo	Fri 23-Dec-2022 00:00 (12:00 AM)
Sydney	Fri 23-Dec-2022 02:00 (02:00 AM)

Or in your local time:

• https://www.timeanddate.com/worldclock/fixedtime.html?msg=Node.js+Foundation+Security%20WorkGroup+Meeting+2022-12-22&iso=20221222T1500
• or https://www.wolframalpha.com/input/?i=03PM+UTC%2C+Dec+22%2C+2022+in+local+time

Links

• Minutes Google Doc: https://docs.google.com/document/d/13RMAMuw4S4jYLSN3JMLwV5qMXK3llxryOxu_ICXjxZQ/edit

Agenda

Extracted from security-wg-agenda labelled issues and pull requests from the nodejs org prior to the meeting.

nodejs/security-wg

• Abort when vulnerable flag #852
• Add OSSF Scorecard #851
• Node.js Security WG Initiatives 2023 #846
• Automate updates of all dependencies #828
• Permission Model #791

nodejs/nodejs-dependency-vuln-assessments

• Recursive support on Node.js dependencies #89

Invited

• Security wg team: @nodejs/security-wg

Observers/Guests

Notes

The agenda comes from issues labelled with security-wg-agenda across all of the repositories in the nodejs org. Please label any additional issues that should be on the agenda before the meeting starts.

Joining the meeting

https://zoom.us/j/92309450775

• link for participants: <>
• For those who just want to watch We stream our conference call straight to YouTube so anyone can listen to it live, it should start playing at https://www.youtube.com/c/nodejs+foundation/live when we turn it on. There's usually a short cat-herding time at the start of the meeting and then occasionally we have some quick private business to attend to before we can start recording & streaming. So be patient and it should show up.
• youtube admin page: https://www.youtube.com/my_live_events?filter=scheduled

[RafaelGSS]

Hi team! @nodejs/security-wg

Could you please react to the issue of whether you can participate in this one? 👍 and 👎.

We might have an interesting discussion about the OSSF Scorecard and I'd like to have most of our team present. If not, we can skip this one and join on Jan 5th (as per schedule).

[mhdawson]

EDIT: sorry was thinking of next week I can make the second half.

[RafaelGSS]

Alright. Looks like our team won't be able to make it this week.

Hope to see your all next year! Have a lovely holiday