Skip to content

2022-09-01.md

Latest commit

 

History

History
54 lines (38 loc) · 2.25 KB

2022-09-01.md

File metadata and controls

54 lines (38 loc) · 2.25 KB

Node.js Security WorkGroup Meeting 2022-09-01

Links

Present

  • Security wg team: @nodejs/security-wg
  • Rafael Gonzaga: @rafaelgss
  • UlisesGascon: @ulisesgascon
  • Facundo Tuesca: @facutuesca
  • Thomas GENTILHOMME: @fraxken

Agenda

Announcements

*Extracted from security-wg-agenda labelled issues and pull requests from the nodejs org prior to the meeting.

nodejs/security-wg

  • Best Practices Document #819

    • Removed the Assumptions tab
    • Next steps:
      • Rename the threat list to a user-friendly title
      • Split specific mitigations into a separate blog post/document
      • e.g Instead of pointing policy as a mitigation, would be great to have Using Policies to mitigate X.
    • Once the above steps are concluded, we can open a pull request.

  • Automatic check for dependencies' vulnerabilities in Node.js CI #802

    • Maintaining blacklist in the Node.js repository is hard.
      • Backport it to active release lines is worse
    • Facundo suggested to move the blacklist to the nodejs-dependency-vuln-assessments repository
      • Rafael said that blacklist might be completely superseded by GH Issues
      • Discussions around potential fixes
    • Rafael suggested creating a root issue and making it available in the security-wg agenda, to not lose the track of those vulnerabilities
      • Even if an vulnerability doesn't affect Node.js, it might affect in the future.
        • e.g: Vulnerability in InflateX is tagged as does-not-affect-nodejs, a week later someone uses that function

  • Threat Model #799

  • Permission Model #791

  • feature request for require.pure(id) or pkg.pure:true #467

Q&A, Other

Upcoming Meetings

Click +GoogleCalendar at the bottom right to add to your own Google calendar.