Node.js Security WorkGroup Meeting 2022-09-15

[mhdawson]

Time

UTC Thu 15-Sep-2022 14:00 (02:00 PM):

Timezone	Date/Time
US / Pacific	Thu 15-Sep-2022 07:00 (07:00 AM)
US / Mountain	Thu 15-Sep-2022 08:00 (08:00 AM)
US / Central	Thu 15-Sep-2022 09:00 (09:00 AM)
US / Eastern	Thu 15-Sep-2022 10:00 (10:00 AM)
EU / Western	Thu 15-Sep-2022 15:00 (03:00 PM)
EU / Central	Thu 15-Sep-2022 16:00 (04:00 PM)
EU / Eastern	Thu 15-Sep-2022 17:00 (05:00 PM)
Moscow	Thu 15-Sep-2022 17:00 (05:00 PM)
Chennai	Thu 15-Sep-2022 19:30 (07:30 PM)
Hangzhou	Thu 15-Sep-2022 22:00 (10:00 PM)
Tokyo	Thu 15-Sep-2022 23:00 (11:00 PM)
Sydney	Fri 16-Sep-2022 00:00 (12:00 AM)

Or in your local time:

• https://www.timeanddate.com/worldclock/fixedtime.html?msg=Node.js+Foundation+Security%20WorkGroup+Meeting+2022-09-15&iso=20220915T1400
• or https://www.wolframalpha.com/input/?i=02PM+UTC%2C+Sep+15%2C+2022+in+local+time

Links

• Minutes Google Doc: https://docs.google.com/document/d/1jtQAcpWJ-KYX3YOIUp1MwPG4Xjfa7TLxpwc8hmwQcdQ/edit

Agenda

Extracted from security-wg-agenda labelled issues and pull requests from the nodejs org prior to the meeting.

nodejs/security-wg

• Best Practices Document #819
• Automatic check for dependencies' vulnerabilities in Node.js CI #802
• Threat Model #799
• Permission Model #791
• feature request for require.pure(id) or pkg.pure:true #467

Invited

• Security wg team: @nodejs/security-wg

Observers/Guests

Notes

The agenda comes from issues labelled with security-wg-agenda across all of the repositories in the nodejs org. Please label any additional issues that should be on the agenda before the meeting starts.

Joining the meeting

https://zoom.us/j/92309450775

• link for participants: <>
• For those who just want to watch We stream our conference call straight to YouTube so anyone can listen to it live, it should start playing at https://www.youtube.com/c/nodejs+foundation/live when we turn it on. There's usually a short cat-herding time at the start of the meeting and then occasionally we have some quick private business to attend to before we can start recording & streaming. So be patient and it should show up.
• youtube admin page: https://www.youtube.com/my_live_events?filter=scheduled

[mhdawson]

Not sure why this did not generate earlier, but ran the automation to get it created now.

Wanted to mention that I'll miss the first 30 mins but will be there for the second 30 mins if its still going.

[mhdawson]

@RafaelGSS FYI, late created issue.