Reaching out to other projects of the OpenJS Foundation

[vdeturckheim]

We should probably start to reach out to other projects in the Foundation to check which ones would be interested in building a larger security community around JavaScript.

Do we have any way to setup such discussion?

[mhdawson]

One the CPC is established there will be representatives from each of the projects and it should be pretty easy. At this point @jorydotcom would be the best intermediary. It might be good to wait for the CPC to ramp up but if we want to start earlier than that then we could start by reaching out to Jory for contacts.

[vdeturckheim]

@mhdawson thanks for the clarifications! Let's wait for the CPC indeed.

[jorydotcom]

@vdeturckheim in the interim I can sent an old-fashioned email to our old-fashioned JSF mailing list pointing folks to this repo!

[vdeturckheim]

@jorydotcom thanks a lot! Let's discuss this in our next meeting!

[christian-bromann]

I am in 💪

[sam-github]

Discussed at #541 , removing from agenda (but please add back if it should be discussed again).

[sam-github]

related: openjs-foundation/cross-project-council#326

[mhdawson]

This was mentioned in the CPC meeting today in the context of openjs-foundation/cross-project-council#326. I think its the right time to discuss/make a decision on what we think is best.

@nodejs/security-wg what are your thoughts? I'm thinking it would make sense to have a group at the OpenJS level, and that the ecosystem triage might fit at that level as well.

[lirantal]

I think that's a good idea and perhaps that's an additional one on top of the Node.js one. Just a thought, but I figure that at that level there will be many project ecosystems and so processes and systems (i.e: H1) might vary. So to say, I don't think we'd be copy&pasting the Node.js Security WG to the OpenJS as-is.

[MarcinHoppe]

If I understand things correctly, the scope here is slightly different: for the Node.js ecosystem we are handling responsible disclosure to a large extent and for OpenJS right now we are more interested in having consistent policies across several high profile projects. Then helping those projects out from triage and disclosure perspective (as we do today for Node.js) would be the next step.

@mhdawson @lirantal Does it sounds reasonable?