Node.js Security team Meeting 2023-11-23

[mhdawson]

Time

UTC Thu 23-Nov-2023 15:00 (03:00 PM):

Timezone	Date/Time
US / Pacific	Thu 23-Nov-2023 07:00 (07:00 AM)
US / Mountain	Thu 23-Nov-2023 08:00 (08:00 AM)
US / Central	Thu 23-Nov-2023 09:00 (09:00 AM)
US / Eastern	Thu 23-Nov-2023 10:00 (10:00 AM)
EU / Western	Thu 23-Nov-2023 15:00 (03:00 PM)
EU / Central	Thu 23-Nov-2023 16:00 (04:00 PM)
EU / Eastern	Thu 23-Nov-2023 17:00 (05:00 PM)
Moscow	Thu 23-Nov-2023 18:00 (06:00 PM)
Chennai	Thu 23-Nov-2023 20:30 (08:30 PM)
Hangzhou	Thu 23-Nov-2023 23:00 (11:00 PM)
Tokyo	Fri 24-Nov-2023 00:00 (12:00 AM)
Sydney	Fri 24-Nov-2023 02:00 (02:00 AM)

Or in your local time:

• https://www.timeanddate.com/worldclock/fixedtime.html?msg=Node.js+Foundation+Security%20team+Meeting+2023-11-23&iso=20231123T1500
• or https://www.wolframalpha.com/input/?i=03PM+UTC%2C+Nov+23%2C+2023+in+local+time

Links

• Minutes Google Doc: https://docs.google.com/document/d/11l2KWrMIzywSj_seO_4Xl24_Wq_hTs0Rz1AKPjPiFJg/edit

Agenda

Extracted from security-wg-agenda labelled issues and pull requests from the nodejs org prior to the meeting.

nodejs/security-wg

• NodeJS Code integrity on Windows #1149
• Amir from ostif.org - Discuss possibility of consulting engagement with security expert in November/December at 2023-11-09 3pm Security-WG meeting #1145
• Have a SBOM for Node.js? #1115
• License checker process/script #1104
• Audit build process for dependencies #1037
• Initiative for CII-Best-Practices for Nodejs Projects #953
• Permission Model - Roadmap #898

Invited

• Security wg team: @nodejs/security-wg

Observers/Guests

Notes

The agenda comes from issues labelled with security-wg-agenda across all of the repositories in the nodejs org. Please label any additional issues that should be on the agenda before the meeting starts.

Joining the meeting

https://zoom.us/j/92309450775

• link for participants: <>
• For those who just want to watch We stream our conference call straight to YouTube so anyone can listen to it live, it should start playing at https://www.youtube.com/c/nodejs+foundation/live when we turn it on. There's usually a short cat-herding time at the start of the meeting and then occasionally we have some quick private business to attend to before we can start recording & streaming. So be patient and it should show up.
• youtube admin page: https://www.youtube.com/my_live_events?filter=scheduled

[marco-ippolito]

Cc @prabhu

[rdw-msft]

Hi @mhdawson.

I will not be able to attend the meeting on Thursday. Can we move the NodeJS Code integrity on Windows discussion to the next occurrence of the Security team meeting?

Also, is there a posted calendar for future security WG meetings?

Thanks!

[RafaelGSS]

@rdw-msft You can check it out at https://nodejs.org/calendar.

[RafaelGSS]

I will start the meeting in a sec.

[RafaelGSS]

@Amir-Montazery will you join?

[Amir-Montazery]

yes! Looking for a zoom link