doc: revise security-reporting text in README - #23407
Conversation
Sorry, something went wrong.
Simplify and clarify the security-reporting text in the README. Now is also probably a good time to ping the security triage folks to make sure the text is still accurate.
|
@Trott build started: https://ci.nodejs.org/blue/organizations/jenkins/node-test-pull-request-lite-pipeline/detail/node-test-pull-request-lite-pipeline/1191/pipeline |
Sorry, something went wrong.
|
How do I find out who is on nodejs-79566c66a30b0312@forwarding.hackerone.com so I can ask them if the current text and these changes are accurate? I can just email the address, I suppose, but what if I wanted to audit who is on the list? @nodejs/security-wg |
Sorry, something went wrong.
|
what is that nodejs forwarding address for? seems to be an alias to the HackerOne Node core program? If so, @vdeturckheim should have access to see who is participating there. Text LGTM. |
Sorry, something went wrong.
security@nodejs.org is the address we ask people to use when reporting security vulnerabilities in Node.js core. The alias is defined in https://github.com/nodejs/email/blob/31a4b5cd3791d4cf14c484ac07574da0647921ee/iojs.org/aliases.json#L46-L51. That's basically all I know, though. Although I imagine I could find more digging through git history and issue trackers spread out across the org. I'm hoping someone knows and will provide the answer, though. |
Sorry, something went wrong.
|
Got it. I wasn't aware that we forward that directly to HackerOne. |
Sorry, something went wrong.
|
I theory the list is here https://github.com/nodejs/security-wg/blob/master/processes/security_team_members.md#team-that-triages-security-reports-against-node-core but it is highly outdated. I'll PR the updated list after lunch |
Sorry, something went wrong.
|
So I updated the list as of nodejs/security-wg#414 |
Sorry, something went wrong.
|
OK, so for this change, /ping @cjihrig @indutny @jasnell @mcollina @mhdawson @MylesBorins @rvagg @vdeturckheim |
Sorry, something went wrong.
MylesBorins
left a comment
There was a problem hiding this comment.
LGTM
Sorry, something went wrong.
mcollina
left a comment
There was a problem hiding this comment.
LGTM
Sorry, something went wrong.
Simplify and clarify the security-reporting text in the README. Now is also probably a good time to ping the security triage folks to make sure the text is still accurate. PR-URL: nodejs#23407 Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com> Reviewed-By: Yuta Hiroto <hello@hiroppy.me> Reviewed-By: Myles Borins <myles.borins@gmail.com> Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>
Simplify and clarify the security-reporting text in the README. Now is also probably a good time to ping the security triage folks to make sure the text is still accurate. PR-URL: #23407 Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com> Reviewed-By: Yuta Hiroto <hello@hiroppy.me> Reviewed-By: Myles Borins <myles.borins@gmail.com> Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>
Simplify and clarify the security-reporting text in the README. Now is also probably a good time to ping the security triage folks to make sure the text is still accurate. PR-URL: #23407 Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com> Reviewed-By: Yuta Hiroto <hello@hiroppy.me> Reviewed-By: Myles Borins <myles.borins@gmail.com> Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>
Simplify and clarify the security-reporting text in the README. Now is also probably a good time to ping the security triage folks to make sure the text is still accurate. PR-URL: #23407 Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com> Reviewed-By: Yuta Hiroto <hello@hiroppy.me> Reviewed-By: Myles Borins <myles.borins@gmail.com> Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>
Simplify and clarify the security-reporting text in the README. Now is also probably a good time to ping the security triage folks to make sure the text is still accurate. PR-URL: #23407 Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com> Reviewed-By: Yuta Hiroto <hello@hiroppy.me> Reviewed-By: Myles Borins <myles.borins@gmail.com> Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>
Simplify and clarify the security-reporting text in the README. Now is also probably a good time to ping the security triage folks to make sure the text is still accurate. PR-URL: #23407 Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com> Reviewed-By: Yuta Hiroto <hello@hiroppy.me> Reviewed-By: Myles Borins <myles.borins@gmail.com> Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>
Simplify and clarify the security-reporting text in the README. Now is also probably a good time to ping the security triage folks to make sure the text is still accurate. PR-URL: #23407 Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com> Reviewed-By: Yuta Hiroto <hello@hiroppy.me> Reviewed-By: Myles Borins <myles.borins@gmail.com> Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>
Simplify and clarify the security-reporting text in the README. Now is
also probably a good time to ping the security triage folks to make sure
the text is still accurate.
Checklist