Node.js Security Working Group, 3 Jan 2019

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Security WG meeting - Jan 3 2019

Description

https://github.com/nodejs/TSC/issues/622

A

So welcome to the node.js community security working group team meeting for or security working group meeting for January 3rd 2019.

A

We'll start with the standard agenda, as outlined in the issue, so first of all is: does anybody have any announcements that they'd like to share sure.

B

So, a little while back we had a brief discussion about integrity checks being added to node. The PR has gone mostly silent from the objectors, so I'm gonna try to land it flagged and the next few days or early next week. So if you have any final objections, go there and the.

A

Issue number that you can post in the wall a link.

B

So that's one announcement and then there's a second announcement. The modules working group wanted to get in touch with the realms people who work in tc39 there's some stuff. If anybody wants to join calls from the tc39 side with some security stuff, just get a hold of me and we can get you added to the invite list. That's it. Okay,.

A

Are there any links to issues or anything like that with more details, we could add.

B

On there as well there's one on the modules working group, we can just share it for now, since it's just telling people where to go.

A

Yeah I've, just an existing issue like that, would be perfect. Yeah.

B

Basically, just join this Google group, which is named for historical reasons and.

B

Calendar stuff, that's it and.

A

What was the did you paste that Google Groups? um What are your module issues right? Okay, you're.

B

Just gonna close that issue because it's just used to tell people where to go so.

A

Got more info on that? Okay, any other announcements.

A

If not, okay, we'll move on to the issues that were tagged for the agenda. The first one is no js' security working group, a nominate, Matt Austin to join the security working with the triage team, I think Lauren. You raise that one yep.

C

So if anyone has any objections or does it have any objections proceed with that, we got already Schiphol of lost ones in it. I.

D

C

Suggest what is it I will.

D

Close one right now, oh I.

C

Saw so my head is working on contrast and he is being active on his slack channel for quite a while that commenting too much, but on some of it he had stuff to say so, generally still most of the time anyway, and he had. He has also some experience, at least for the last four years.

C

I think working at node, so he's interested to try and work with us, and some of it is especially I think the triage which would use a lot of help so that we don't get past all the time on the ecosystem program.

C

So it sounds okay with everyone.

A

Yes, I just took some notes said you know. If anybody objects come in the issue, otherwise, he'll be on board the next week, sound good, yeah, okay. The next issue was 4 1 5, which is vulnerabilities from academics for.

C

One five years so I, actually that that to me I've totally reached out to Davis we talked, we tried to schedule for for ticket was last row two weeks ago, but we both kind of had to reschedule again and basically it's still the same shadows. I haven't had a chance to connect with him I'm, just gonna, try and ping him again see if you get his availability and just work on it.

C

So the idea with that is just to try and see if we can float some of those vulnerabilities from academics or any resources that he has to the to the hacker one program or basically just to PR them to their vulnerability at the rates. That's it, but I need some information from here. First about it, so it still stable. We can probably remove this security working group agenda at this point. Okay,.

A

If you want to go ahead and do that.

A

Okay, the next one is number 402 refactor report ID to be auto-generating.

C

So I think it was a discussion with.

C

E

D

E

It's for one two or four okay, it's 402.

C

Yeah yeah, that's the one with Sam, so I'll try to summarize it as we went a little bit a lot forward and then big pink back with some jumping in and you know rightfully. Okay I just want us about a change. So the idea is that we are going to do two things that are potentially gonna, be breaking or movie database. One is moving.

D

C

The data base of the runner abilities to the different triplets vladimer is created and will own the process for that. So all the volumes will just move to somewhere else anyway, and these tickets specifically kind of says that we are going to also change the ID so that we can also regenerate the report, ideas automatically and not manually.

C

What I think Sam was pointing out and rightfully as well is that I don't think we have made it clear that we are also going to change all the reports ideas. So if I report a Kiwi created, like you know what the incremental one like five four one, five or something like that, I was assuming that we are going to also change those as well like retro actively, and we can have I detailed, a patch that we can kind of seal, still save some compatibility. For example, we can still leave like old.

C

You know original ID, something and then just take the original one, and we can also also yeah. We can also create, like a CSV export, with like a mapping between the old int in use. So anyone is like working on a database or integrating with it. He has like a really easy, CSV or JSON upgrade path to just random map it internally, if you're doing that, so I think we should probably anyway do that, regardless of what we decide but I think the end of the bottom line of what I'm trying to say.

C

After all, the intro is I. Think Sam is saying we should try not to change the old, the old ideas, the old report, ideas and that's kind of the open question that we have. If we want to do that or not.

A

I guess there's there's two possible to things like one is changing the format of the ideas, IDs can break, say an existing tool or something right and then I guess if if then, on the other hand so like that would stop you even if we left the old one. That would stop you from getting updates right. What.

C

Do you mean why? Because we're also moving it well,.

A

Well, no just like, if you change the ID format and the tool uses the old format, it's gonna be broken right, like.

C

A

Even if you left all the old IDs as aliases, you, wouldn't you wouldn't get new things right. Yeah.

C

Because it's it's, it's a different fill type as well. We're gonna move two strings from numbers right now. All.

A

Right right, so then the question in my mind, comes down to is like okay, it. You know, leaving that to me changing the format is the bigger part of the to. If you, then, if you can leave the old format, the old ID says: aliases, that's good, but you're still potentially broken some things.

C

A

So it's like: have we have we socialized? That I mean my quick read? Was we've socialized that we're moving the database, but have we socialized that the IDS are changing.

C

Yes, I think from that perspective we did but I think Sam's point was that we didn't say that we are also changing like the old ones, not just in new ones. I think.

D

That was the point, but.

C

But yeah we gave I think from socialising this and announcing it. You know it's time for this to the outer for someone to to pick it up and even ask us this question, like some did right from that perspective, I think we are okay but yeah if we want to decide to keep the old ones I'm.

C

Also generally, okay, with that I mean we can do it as a gradual step like we can just keep the old ones as they are and the new ones you know will create in the new way and- and you can, we can move all of that at once, and then afterwards we can also, you know, say you know. The next three months are also making a change to.

C

You know change all the old ones to be compatible with you once you know, and then you tell gives you some time to you know to upgrade for that, but before anyway, gonna do it, then you know I, think in enough time that we can also just do it. Our one set up later I mean.

A

I think and why I'm in my mind, it'd be good to if we can leave the old ie if the new and old don't conflict, then leaving the old ones, there doesn't really hurt anything just doing that and duplicating them, like I. Think you'd want to be able to get all the ideas using the new format so that, if you change your tool to use the new format, you're, not you know only getting part of the data.

A

D

A

Would be like have have everything that has a new ID, so I guess you'd end up with two IDs for the old ones. This.

C

Is okay, but the thing is that, right now we have for each report like an actual ID field right and I'm, going to change it for them. So, like it's format, change for the new reports right, okay, I, don't want to call them like new ideas, because that's just going to be confusing. You know when we change those as well new new. What is once right.

A

Okay, so it's not the name? Okay, so it's the contents of the report itself. Yes,.

C

So like so, the new reports are gonna be graded with a new format, but you know the existing field. Id is going to change from the old. You know one to treat you did. The new format that punches I know David go ahead, no.

D

Is there any problem, because I mean that that's gonna be super kind of tricky? What I will say? Yes, he is like what, if we do a cutoff points tomorrow or whatever is ready, and then we start using the new IDs so up to the report, 730 something will t be all IDs and then after that will be the new IDs yeah.

E

That might be the way to go. Can you we.

D

Have the ID field, then the ID field is random string. So we don't really employees, not random is ns like the prefix that we have and anyone.

C

D

So like, if the last one is 437 right now and we switch to the new one, so the from 438 there will be like NS working group and then the new ad. So at some point we change the numbers for the alphanumeric. Oh yeah,.

C

This is the I think this is the point to do it like. How would how we will change everything? Is the memory Asian runnin and we'll also change the old ones to this new one.

D

C

Change the old ones you just leave it there, like I, just want to tree.

D

Yeah and then the new ones will be yes, alphanumeric.

C

Yeah, so this is the suggestion that we can go. It I think this is kind of the the bottom line of of this. The only thing is that we were so first of all from us who would have to support you know from the test and the validations. You know to kind of fields right like an ID one and the string one and it doesn't everything and any way to like I, think Michael said it. It might break someone consuming it anyway, because it's like it's like a different format. Your.

E

C

Ready for it anyway, so something so like I, don't, but.

A

I think I think it's like changing the name of something that's already out. There is like I, we may be better off just leaving it as it in the old ones, as is, and then there's new IDs going forward and.

D

In the old one sisters, if it is some sectional data, so so might have that as a as a hard reference in their database yeah. That could be yeah.

C

But yeah, of course, but we have like the idea, was to have for the old ones like you know, to generate the new ID for them, but also, like you know, or regional ID field and then give the reference for that, because I mean, if any, if someone kind of references, the exact URL on github they're, not gonna, it's gonna break anyway, because we're moving to the new repository, a hard thing will not work anyway.

C

Yeah I'm good with with this option to leave them I'm just thinking it's people would anyway need to upgrade to that and make changes if you're consuming it anything everything will change so I think.

A

It would be in you know, I'm thinking like why don't we leave those, as is make the first change and there'll be some feedback as to whether that's broken people or not mm-hm.

C

A

Maybe you said like considering renaming them later on would make sense, yeah.

C

Yeah we can do it like two steps: the gradual migration. That's also really good thing.

D

Yeah make sense also, and do we need to send an announcement on Twitter or somewhere saying that we are planning to rename the IDs. So major providers like it's me or others, shoes right for that view. Yes,.

C

So I think we think that was Michael asking before we do socializing, if that's what I understood from it, but like yeah, we did that like not three months ago or something like a controller, remember exactly when even more maybe so I feel like if we're all in agreement on this I'm gonna roll it out, I will obviously do it more before we are actually going to do it like I, wouldn't give like you know a couple of weeks for the one to just catch. This might even open.

C

Maybe a new meta issue just for people too, that have signed up to the repository we'd get like a new issue. You know a new announcement coming up.

C

Yeah, you can yeah I, think that might covered it.

A

Yeah I think some some sub public is some plus the publicity saying you know, as we announced you know three months ago, we're doing this and we can all tweet and get the node account to retweet and stuff, and just saying we're moving forward on this date would be good.

C

By the way, another thing I think that all the references to our vulnerabilities are actually not using the ideas. They are referencing hacker one yeah I think they're referencing, like hacker one is resource I, just.

D

Took that yes, you're right yeah.

C

Right I mean, like I, didn't check everyone and one advisory that went out on every classroom, but I think that this is what I noticed when people reference us so I think it's not really going to break anything specific. Unless someone was counting on it. What I.

A

Always seems for node, we somebody gets broken by stuff.

C

Okay, but we're gonna, so I'm gonna comment on the issue to basically agree with Sam on doing this, and as as a gradual change like fine I, will not update everything and I think afterwards like if we we can consider, maybe just making also the old ones, gives the new ideas or something that would make sense. It.

A

Sounds good, okay, anything more on that one. Before we move on to the next issue, I.

A

Guess really? The next issue is the same issue right. It's my great mul nur ability database to to its own repo I. Think.

C

That's the point is.

A

But we basically just had the session right, II.

C

There happily died the.

D

Different this one is actually.

A

C

The two vulnerabilities to the different security, advisories, ripples right and the other one is just yeah formats and also discussed the discussing this with polymer I think we said that between us. We don't really want to tie the two changes together. So we can like just apply all the the new format, and you know whenever we move to the new repo. We just think those as well so, okay.

A

So anything to discuss on that one, or is it just that it's going.

C

Educates just waiting for Vladimir to pick it up a that's it and, of course, if anyone wants to just figure, what's going on the security advisory to oppose and see, if there's anything, they can help with or just jump on anything to speed it up, I think well,.

A

Sounds good, okay, so that's everything that we had on the agenda there, any other things. People want to talk about.

D

And I have something- and it's I got a couple of messages on on the hacker one program for the third-party vulnerabilities about how long takes for a CBE to assign and I know. We have discussed that before, but is there something that we can do to speed up the CBE assignment?

D

C

Are you doing this today through hacker rank? Yes on just requesting the CV from the online web report, yeah, okay,.

A

So how long is it taking I.

D

Am actually not sure I can check, but you see I requested once all day. Well, actually, probably because placements but I know the email is super slow, but through the website I don't know right now. I need to check.

C

So I don't know of any way to speed it up, but yeah would be interesting, I think to figure out guess what how about like? How long does it take to assign that I would.

A

Find out yeah if it's a day or two, it's like okay, I, don't think I'd complain too much yeah.

C

No, it's not that one is more.

A

C

So some way justice like I, just remembered it's something that I think we should look into I want you on my screen for that. But if we go to the program settings to request, CV is.

C

We can see if you know some, what's the status for some of them, so so I'm, seeing a lot of CVS that are are in a status of needs, action which usually means that we didn't give them enough information. So it could be stuck for that. So we should probably go ahead through that list and I'll ping you on the slack channel, with the exact models that we have. That needs the action and everyone can just work. Ie I created what.

D

Like three four three days ago and I think they went straight away into this. Need suction I think the need suction means that the people from Hydra wanna action in Veneto to provision CB I, think.

C

Yeah, so the leads action here is they would need to wait for it to be public before they can submit it.

C

That's what it looks like: okay, so I'm gonna post it on the channel anyway, so you can see, but if there's one thing specific that you want to check, we can also check it.

D

No, it's fine is yes just to make sure that we are doing the right thing so.

A

Yeah, if you want to gather the some data like for how long it's taking- and you can get these done- that we can see if we think it's a problem or not err, I mean our only I mean.

D

A

Always go go to them and say: if it's taking too long saying hey, is there any info? The only other option is like being our own CNA, but that then requires additional work to manage the CBE's ourselves yeah.

D

It's not an issue, it's not an easy call. So.

A

The other thing I will mention is there's they're setting up a CNA conference. They have one like I think once a year for CNAs, and since we act as the note CNA, we could send somebody. So if anybody's interested, let me know and I'll forward them on the email that I got saying: hey participate in the poll or whatever for the timing.

A

Okay, anything else for.

C

Me I was just saying mighty word. He just asked, maybe in the gyms like or something if someone wants to join that yeah, okay, it's good idea or the meeting notes or something. So if someone widgets you just a little just think you.

A

Okay, any other topics for this week.

A

If not I'll call it a day and close the meeting right.

C

A

C