Create a security team

[rvagg]

We need a small group of people who receive emails to security@ addresses (currently just security@iojs.org because that's all I have control over, but eventually security@nodejs.org too).

My preference would be for it not to be the entire TSC but a smaller subgroup that can quickly and discretely and escalate issues in the appropriate way. But how we construct this is open for discussion of course.

I'd like to put my hand up for serving in this role along with a couple of others.

Discuss.

[rvagg]

Also:

This is currently being controlled here: https://github.com/nodejs/email/blob/master/iojs.org/aliases.json

We'd need a ## Security section on the README to list this and explain the steps to take if you find a vulnerability.

[bnoordhuis]

I volunteer. Do I need to file a PR for that aliases file?

Also, /cc @nodejs/crypto - I believe @indutny is or was on security@nodejs.org and @shigeki probably makes a good addition as well.

[rvagg]

let's see how it shakes out in discussion, the TSC probably needs to sign off on the final list, we'll give it another week

[indutny]

Add me up.

[indutny]

Btw, it is probably a good manner to cc people when issue is created. Not everyone is watching the repo.

[rvagg]

/cc @nodejs/tsc

[Fishrock123]

Original issue: nodejs/node#430

[jasnell]

+1... Sign me up!

[cjihrig]

I would like to be on the list.

[shigeki]

Please add me to the list.

[mhdawson]

I'd like to be on the list as we need to quickly address issues in the IBM internal builds as well

[rvagg]

Proposing a security@ team:

• @rvagg
• @bnoordhuis
• @indutny
• @jasnell
• @cjihrig
• @shigeki
• @mhdawson

[misterdjules]

Joining the discussion a bit late, sorry about that. There is already a security@nodejs.org mailing list, and a process outlined at https://nodejs.org/about/security/ that a lot of people have been using to report security issues. Why not start from here?

@rvagg If you're interested in having control over the management of the security@nodejs.org mailing list, just say the word.

[trevnorris]

Is there a passive participant position? Want to be part of this so I know what's going on, but doubt I'll have much to contribute outside of any security bugs I find.

[misterdjules]

@rvagg Also, in case it wasn't clear, I should mention that Todd Benzies from the Linux Foundation is now managing the nodejs.org Google Apps domain, so it's really managed by the Node.js Foundation, not Joyent.

[rvagg]

@misterdjules thanks for the context, I wasn't aware of the Node.js security@ list or procedure (although I was looped in to the recent HP email thread which I guess should have clued me in!). I did a quick search of the repo / README and didn't see anything and since we don't have anything for iojs.org I figured this would be an overlapping concern but it seems not, yet anyway!

This actually comes from finally having MX set up for iojs.org so we can do email addresses and the only really pressing one is security@ so I wanted a list of people to put here: https://github.com/nodejs/email/blob/master/iojs.org/aliases.json - I also assumed we'd use the same setup (Mailgun) for nodejs.org continuing on from this issue.

I'm happy to sit on this issue for now then, since we have a security@nodejs.org procedure in place that's all good. I'll set up an interim thing for iojs.org.

[rvagg]

nodejs/node#1948 - added a section to the io.js README

https://github.com/nodejs/email/blob/master/iojs.org/aliases.json#L3 - bounce email to security@iojs.org to security@nodejs.org

[bnoordhuis]

Who is going to add the people on the list to security@nodejs.org?

[misterdjules]

@bnoordhuis @tbenzies from the Linux Foundation can do that.

[misterdjules]

Sent an email to Todd Benzies and asked him if he can join this thread.

[tbenzies]

The following people have been added to security@nodejs.org:

@rvagg
@bnoordhuis
@indutny
@jasnell
@cjihrig
@shigeki
@mhdawson

However, michael_dawson@ca.ibm.com is bouncing -- is there a different email address that I can use?

[misterdjules]

Thank you @tbenzies!