Node.js Security Working Group, 22 Apr 2019

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Security WG meeting 2019-04-22

Description

https://github.com/nodejs/bootstrap/issues/114

A

As soon as the progress bar pops up either actually live, it's a weird, weird thing: okay,.

B

B

C

To turn it off them, don't.

A

There you go those.

D

Interesting that got a little cycle there.

A

D

Delaying the loop okay, so this is a let's kick this off. So this is the non-security work and I just foundation is pretty working group meeting for April, 22nd 2019 and let's say it's a live for viewing on YouTube for commentary and the agendas and the nodejs. Ich esprit working group issues: five, one nine and go start going through the agenda. Yep yeah.

E

D

Let's see regular schedule for any recent releases issues, 647.

D

D

So I I think Michael's well kind of kicked up. The idea of perhaps like scheduling security releases in every three or four months. Sorry doesn't get a lot of enthusiasm. There's been anybody who hates the idea. Does anybody here have any opinions on to whether that's a would be useful to do that? I.

A

Guess the only insight I'd be curious about because I don't have. This insight is in node core when security releases are happening or when people are working on city releases like would this create?

A

Would this be like effective for the people who typically work on security releases, or would this cause like too much pressure, unlike Chalker or someone who's like working on some kind of thing and a deadline and like I guess, I'm, not sure.

C

Like today, their ad hoc, so either something high severity comes in and that basically triggers like a security release in the short period of time. So something like the OpenSSL, you know, there's an update. It's gonna have some high enough severity, zwi figure. Okay, we got a release within a few days or the next day after that, alternatively, get a number which are sort of lower priority and you know, haven't been disclosed yet and those kind of I think today is like they. They are they're.

C

People may or may not look at them until we just saw ad like okay, let's do a security release either for some other reason, and then we decide what we can get in or we say it's been long enough. You know we need to you, know, roll out a security release so.

A

I'm curious, it would just apply to like only those low and medium sororities and then, if there's still like an open, SSL thing, that's a high severity. You just cut that, no matter what yeah I mean yeah yeah.

C

A

The high severity.

C

Ones have to go ad hoc, and you know it's just if there's any value in instead of just waiting when told some random time, when we think there's enough, you say: okay, once a quarter or whatever you try and schedule something into the actual schedule. Yeah.

A

I think that make sense. The only other concern I know, I, see that this was suggested to be discussed by the released working group is like. Do we have enough people in the release working group to sustain that without burning them out? Well,.

C

Yeah I would have to be I mean in theory. It should end up with no more release news. In fact, do you mind up, and you might end up with glass right because you might have a stronger argue to say: let's wait on this one, which is you know, not critical until the next planned release, as opposed to doing one now and then doing another one in three months or whatever right, gotcha, okay,.

D

Give em a chance so what iswhat I saw when I looked at this, so we do about three security releases a year. So if we did one every four months, we wouldn't be increasing the rate and I say mr. B there's basically a spirit. It's a small collection but there's a small collection of pretty low security items to work on.

D

And if you look, if you look in the security work and in the issue 647, you can see that I've kind of posted a summary of all of these security issues in 28 for 2018-2019 as it when I posted it. I can't talk about required, which.

A

D

Message: yeah yeah.

A

You can click chat at the bottom of the bar there and pop it in the link. Thank you.

D

If you look through that, you'll get a bit of a sense of what kind of issues are being in the past, and so what happens as far as I can see is we might fix some things or some people might be working kind of in the background, and so you know like so working on the timeouts a little bit or you know to improve the dos configuration.

D

You know, values to configuration things that can help with das or maybe there's some stuff in the path of the URL module that some people think maybe if this could be exploited, if you're using it for thent occation, maybe so there'll be some stuff like that, and every once awhile somebody'll be like ok come on guys, it's time to really sell this stuff, and then people be like. Oh ok and the next couple weeks will be really busy.

D

So if it was more predictable, if we knew that every four months I would be happening, I think it might. Actually, you don't have to make the deadline if it's low priority, you can let it go to the next one, but it might kind of make it more consistent, easier to schedule or maybe there's no problem and we don't have to work on it. I don't know Mike. Are you I think you quite like that?

D

Yeah I just think I thought it might make things a little bit more predictable and easier to people working on it. Yeah.

C

I mean I think we have the challenge. Sometimes it's like okay, here's the security release and then we gotta figure out with the release team when it sets in because we still need them involved so like I, it might make it easier for them to figure out when to schedule it and versus not I think which is good and and I like it from the perspective that it gives us a at least some milestones to think about like if you're working on one of these lower priority things it's like.

C

Well, if you think it's important enough, you should try and get it into this time right, whereas otherwise we do see that it's like hey. We've decided to do one there's these five other things and people maybe only have a week or two notice right, whereas if they'd had a month's notice, they might have been able to say yeah, okay, I think it's important enough at all time in well giving a weeks notice. They do. You know it's much harder to fit that in yeah.

D

I agree, I, think it'll be helpful to, for that matter, be a little bit less frenetic and perhaps and more yeah. So.

A

I I definitely agree that I think it's actually a really good idea. I'm, the only thing we're like I'm thinking like- and this is totally outside of, like how we work it's more of like how we message this is I, can very much see.

A

Enterprises coming in I, see oh we're, just gonna update every release or every security release, and then, if we either like, we don't have security like patches to ship, they might go. You know six months without updating or you know, I guess. Theoretically, if they were in in a perfect world, there were no security issues for like a year.

A

They might go you're that uncle. Why but I don't think. That's realistic, so I'm curious. What.

D

A

Reviews on this is this: something we're gonna be messaging externally, or is this gonna be purely internal 4rz III.

C

Think the you know, I think we could message externally, like here's the schedule that doesn't mean there won't be ad hoc ones, and it also doesn't mean that people shouldn't necessarily upgrade because these security releases are always cumulative on the latest release.

B

C

If you wait for a year, you're increasing your risk that all the other changes in there right. So really what you want to do is stay up to date, and then you know that the increment of a security release is gonna, be you know relatively smaller than what it would be. Otherwise yeah.

B

A

Like just trying to like practice, my head, I think the people who would be updating only on security releases aren't gonna, be updating regularly anyway, so this is actually probably a better way to push them forward, because they're not going to be ones actively going through and updating their runtimes to you know, improve performance or whatever they're, just gonna, be updating for security and they're gonna be the laggards all right, so yeah in that sense, I define things good, so one additional question I have.

A

This is something this is something that's kind of bugged me for a while, just because I've been working with this file, so in our release metadata, we actually have LTS as a thing as a like a true false flag. There would we also want to do because we're kind of doing it in this methodical approach. Would we also want to add a dirty true pulse, that.

C

Doesn't sound like a bad idea, regardless even.

B

C

We just you know, you know, for an ad hoc release having something that's you can machine read as a security release. Sounds yes, cool. Okay! Is that extra work extra? You know what is that gonna take in terms of load on our release team dad.

A

I, don't know I've no clue, but that's a good question to ask I mean.

C

That might be worth opening a different issue, which is basically you know, should we add a tag in the metadata that says: security, release or not.

A

Lines to the LTS release or not, is that something that what you would repo without going that.

D

I think that I, don't that as much to do with this schedule, I think I, don't I can't see anybody objecting to that. It just seems like a an obviously useful thing to do it would their way to do that would be open in issuing the node.js slash release. We go I issue tracker, Bible ingredients like opening its.

C

To fit into the release process, so that does make sense.

A

Yeah sir I just thought that that might it's like we're doing this methodical thing, but if you think that's totally, that makes sense.

C

A

D

C

Okay, so it sounds like we have I mean you know. Unfortunately, don't have a large group here you mean I, guess we can comment in the issue. We discussed it. It seemed positive here. The the next thing, maybe is to see if there's been any discussion in the release team.

C

Because we need I, think.

C

We need some feedback from them as well, right.

D

Yeah I, don't think they'll have any particular objections. Pro/Con, yes, Matti, oh I mean Mario Raj. Basically the people who actually work under the mises, yeah I think that's basically Mateo and right.

C

That's from the security side from the security's release, side yeah, so you you Matteo and rod, and then I mean it's. We always get a release or from the release team, but I I suspect that actually you're right. If we just say let's, we want to plan these two releases, you know and then that's the release team like they haven't, Devon, objected or anything on the issue. So normally it would just be hey. We want to do this ad hoc one. Maybe now it's just like hey.

C

We were gonna plan these releases, so maybe it is just like: let's try and set some eight and get them into the release, schedule and see if that make that work. So maybe.

D

Was showing up but ya.

D

Wonder if it's worth bringing up in the next release working group, hmmm agenda, yeah.

C

Well I should it should have been I, think I tagged the issue for both, so it might have been discussed. I didn't make the last meeting yeah but as I understand there weren't huge number of people there so.

D

Ok, well, let's, let's tag Liam, okay! Well, let's tag them see if we can get it onto their agenda, I mean, hopefully they can, at least like you ask them for some candidate dates for 2019 yep. They would at least be able to eyeball their their release. Plans don't say well, I would propose a couple days. Yeah.

C

You could probably just felt Bethany- oh not as well she's been helping to coordinate some of the release date stuff. So.

D

C

How to how to best ask for those dates.

C

Or I guess just opening an issue and the repo would do the same thing well,.

D

There's already the issue: I guess I can take the target to tag them in it and asking for a couple dates and then ask Bethany. Yep Joe is fine enough. Anybody else care as they can respond as well sounds.

C

D

D

Okay, well I, think that gives us a plan for that, for that done,.

C

The only thing I'll ask since he's here as well in terms of you know, for the vulnerabilities there seem to be some preset like you'll get a response within a certain amount of or a fix within a certain amount of time, right, I wonder if, on the the hacker one side, we can tweak some of those to then fit our scheduled releases. Oh you're, talking about the the response times! Well, there's sort of the initial response times, but there's so like hey, you know.

C

If it doesn't go out with the next day's or something, then you know it's yes,.

E

You have you kind of have different metrics and you can totally tune those there's like first response time. Yeah there's time to triage, and then there is one for like time resolution. That's an optional one. So you have to turn that off entirely. If you just didn't it that this doesn't make sense for y'all's release, schedule, okay or just increase that to like 90 days or you know some other large number yeah.

C

I mean it could be like if we're gonna do one every four months, it could be a 120.

E

C

And that's okay, so let's set some dates but biggest then that's one other thing: we should just figure out if we need to tweak whatever we've got set really.

E

I'm, not in general I find that researchers are not as concerned on the resolution. You know they want to make sure that just that, like is little you're transparent about it, was like hey. This is you know, will you do this at this time? They're more caring about like okay? Getting that initial response and getting the you know like hey we've, we've confirmed this is a vulnerability. We're gonna get this fixed. You know it's! It's triage type thing yeah.

C

D

Actually had a question about triage I wonder if this is maybe I was given. I just came up, I I know this is injecting the agenda a little bit, but I there's a number of no jeaious issues right now that our have missed their kind of triage time, but it it left me I, wonder if we're perhaps not just setting their state correctly. I'm, not I'm, not crystal clear on what triage means and I kind of looked around to find the definition. Yes,.

E

D

Very much for me, yeah.

E

So triage basically means that you know our kind of standard terminology from triage. Is that okay, you know it's a report comes in and eight that you have certified that it's a valid vulnerability.

E

Then, at that point you know you move it to triage and he can stay in triage stay for quite a while. It's also intermediate states like if you're needing more information you can do, need more info from the reporter and in that sit in the top of their cube and their inbox. So yeah it'd be the state-transition stuff. Is it pretty just because it does affect those metrics, but then also kind of helps? You do with figuring out how to like what state something's in and what you know like.

E

Okay, you, you at least know all the triage issues have are real issues and that are ready to be fixed or already have patches and are just waiting for the next patch relationship.

D

Okay, so should we be bounced, so we should perhaps some of those the issues that are so currently sitting in a state and, let's leave actually are I think are waiting for more info from me. Like there's some negotiation back and forth. It sounds like it's like. If you ask the person question, you should also like bagging the state back to be like waiting for Rick.

E

And you and you can do that the same time. You can do change state to what needs more info and ask the questions, and that is what I call in action. But but you can go ahead. If the questions are yes, go ahead and change it to info and it'll. Take it out of that state. Okay,.

D

I might I might go through the states in and maybe and looked at there a little bit for docs on how to dip I'll use that stuff to me so that we have a kind of a more common pattern. I think where I think some of the like some of the metrics I think look quite bad for us, but when I look through the actual conversations I was like well, it seems like we're doing the right thing. So, okay,.

C

I thought that.

A

C

To the next issue, as well, which is factor-1 gonna, do some of that right.

E

Yes, I mean so that one would help out this as part of this, the man notices offering and we can dive into that, and basically the Ford Foundation is, you know, provided money for is that everyone will basically be doing three things.

E

One is providing a both a technical program manager you're in a program manager just to assist the nodejs team, with any questions do regular, check-ins and whatever frequency that you know you would like just helping you answer any questions you have about how things go separately, there's the actual triage team, our security, analyst equity analyst will basically take incoming reports validate them as best they can. You know they.

E

You know obviously dole they'll do the best they can based off the knowledge they have been. Do so like they'll, see like okay. Is it valid issue, so they'll triage it and if not, they may. They may actually request more information from the reporter to get to narrow it down or, if they're not able to make a decision, though escalate it to you know security work and do security. Triage team I should say to make a decision with that, but it basically takes out the low-hanging fruit of like okay.

E

You know the reports to come in to make sure that they're at least getting into a state where somebody can actually look at the report and make a decision versus the command is like. Okay, with my every reports that are just completely inaccurate or just obviously me more information and then saves all time and then separately, I can also handle any of the predetermined bounties.

E

Like you, you know we have the bounty table that yeah you set I'm can go ahead and pay out all those bounties so that you don't have to and if, if no GIS, if the noj's Foundation worked at some point throw into or funds, then you know can also handle whatever doubts through that as well. But again, these are all options, but these are just what's being offered for free for the no GS project to use I.

D

Think I think I think a few people raised some concerns about. Maybe issues would get closed without at least somebody on note, looking at it and agreeing with the decision of the triage but the hacker when triage team, so it was like one one concerned it was raised. On the other hand, I quite like the idea and having people with you know more comprehensive security background, doing the the initial interactions, and maybe you know they might be able to push back with more authority and also a wider view.

D

Like okay wait, a second, we work with seven other projects and none of them consider this type of stuff to be an issue or or conversely, though, that looks like a small thing, but actually we've seen that exploited in a while. It's.

E

A big deal sure I mean so anytime that if the hacker one triage team were to close it out, it's still available in yields inbox, you can still see all those. So you know if you so choose, you can always go see the report, so it doesn't like hide it from your view. It takes it out of the new state, but you can always just go and look at those close report yourself and choose to reopen them. If you would like right.

D

It doesn't mean that we've given up the ability to disagree- or they don't happen in secret, like the entire conversation- will be right there in front of all right, yep exactly and.

C

I guess we'll still get emails right, so you'll see an email that says: hey we've decided to close this and I. Guess that's an easy to say: well, wait a sec, don't didn't I, don't agree necessarily right! Agree.

E

Yeah, it is totally will be transparent to all of you on. That should not be an issue.

E

Our goal is basically to make it easier for y'all not have to worry about stuff and get your actual.

C

What sounded like in the issue? There was agreement to move forward right, so yep.

D

There was a thing yep.

B

E

There was two things so I think we we already had approval from you all to move forward on the no GSA and I think the question was: are y'all comfortable, also moving word on the nodejs ecosystem side, and so, which is a different type of thing. It didn't seem like anybody had concerns, but I think this is what this meeting or as well.

C

Okay, so, unfortunately, you know Vladimir I know we're quite active on that side. Aren't here today, because I think we should probably want to hear from them. If you haven't heard already well.

E

You so glad said, I mean even in the issue. He said, he's he's plus-one to move forward.

E

He's just you know, wanted to see how things turn out in the meeting and then I think in the actual task itself.

E

Actually, some there's the conversation in flag as well, where folks were positive about this too, so it nobody that I've seen is said anything negative, but you know that's what this meetings for is well.

C

D

C

Objections either so.

E

Okay, well, we can always get started and into a kickoff meeting, and then you know that meeting would obviously have Vlad and others in it. And then we can answer any follow-up questions there. Yeah.

C

Yeah, if everything you know all the feedback, you perfect positive, there hasn't been any there's. Nobody here seem to say no so I'd say yeah feel free to move forward.

D

Is there an issue specifically to the security working groups or the ecosystem issues, because I'm the from our notes here the issues it's that reaches to 506, I I? Don't I mean I read through that issue and I thought it was mostly just about nerdcore I didn't realize it also about the ecosystem. The.

E

Same offering was given to both sides um well,.

D

It's gonna show up in our notes here so it'll be pretty clear, so yeah, so everybody.

D

That seems to be a in favor, okay,.

E

I'm looking forward to beginning this going and get all the help that you need mix, so you don't have to focus on this stuff and as much as you do, and then we can take that out of your hands and then also, if you also change, you can also get your skis from us as well. I know you are see, you'll go.

D

To minor works.

E

But if you don't want to do the paperwork associated with that, then we can do the CDs for you.

C

D

Was gonna say if I suspect, if we're doing everything for each Packer one, that's managed that the easy thing to do will be to have well well, actually, I, don't know if hacker one can allocate a CV for Espen. So since we are a CNA I think that means the miter would refuse to issue unto you uh so.

E

We we get the CVE IDs from mitre I think my turn would probably reply back in like hey. They are CV, they're CNA shouldn't they be doing this and we can reply back and just say: hey, hey, they are the ones doing it be it us so like it's probably just in making paperwork or you know just let them know, but.

C

In terms of assigning a CV II, like you guys, we.

E

Already had blocks it's because we be assigning CV all the time at some of the projects right.

C

That's interesting, okay, so, but you have them in advance. So basically we would have all the same advantages of pre pre-allocated blocks and yeah.

B

D

Think it would make sense, I mean I. Think Cochrane is definitely geared up to do the CV assignment.

C

D

We're doing the more work for them, I think we'll find that doing the CV stuff, for them is the easiest way to go yeah. We.

A

D

We can give it so, maybe by the end of 2019, we can withdraw Wilson by the end of 2019. We'll know if things are working well, if there's any issues, I don't expect any, but we'll be able to decide whether we want to withdraw as a CNA from reminder.

D

And for now, I think we can just leave it and and do whatever necessary paperwork we need to in order to work with packer line, yeah.

E

It don't have context ready, lighter, maybe just give them a heads up that, like they you're gonna, be doing your CDs through hacker wine and just letting them know, though otherwise, we'll you know once that happens, then we'll let them know that suspect matter would include email back and stay like hey. This is weird, but yeah I, don't respect the problem, we'll just say hey. This is this: is them unit through us and.

C

I guess, then you could send them an email to that email that we have right.

D

Okay, so a kickoff meeting for the there should be I think will be to kick off meetings like one for ecosystem, one for cores or at core keep that meeting scheduled. Let.

E

Me check and see if Andrew, that that schedule and.

E

Though he was out lately blessing, it looks like quiet I'll make sure he gets her quiet today.

D

Okay, so is that is that it for that thing and I guess also there'll, be a kickoff meeting for the ecosystem and I will need well everybody who currently is access so and he's interesting to him. Shelf life.

E

I'll get the the meeting scheduled in from both of the groups and get that doing it right.

D

Okay, well, let's see five eleven was so we done with that. Actually I mean I. Think we anything else to say on the managed Parker one service.

D

Sorry, Michael I.

C

Said I, it's good from my perspective.

D

Okay, let's move on to the next one issue: five eleven reaching out to other projects, there's an old foundation.

D

Vladimir was interested in that Jori, calm, I know what I don't know if there's anything for us.

C

Yeah from my perspective, I think the easiest is to wait until the CPC forms, and then we have representatives from all the groups. So that's my perspective is just kind of wait until the there's enough going.

D

C

Bootstrap, the open J's foundation that it's probably worth just waiting, you know another month, so so what happens and then to be easy to figure out the contacts.

D

Okay and I, don't really have any other. You have comments Vladimir's, not here I, don't it doesn't sound like as much else to do for now. Then maybe we should take it off the agenda for next.

C

Yeah I'm; okay, with that.

D

Okay, let's move on attendance in the upcoming collab summit in May journey. Are you gonna, be there yep.

B

I'll, be there okay.

D

So this is a surefire 510. Is there anybody so we're hoping that somebody would put together some of them slides from the working group? Yes,.

C

Yeah, like I, think from the.

C

D

That I can run it. Do you do? Can you +1 this? Oh.

D

So I lost my zoom again.

A

The bar on the bottom, so I, don't know if it matters but I'm, not a member of the working group ah I'm having plus-one it.

D

A

I would like to yeah. Did you within my interests.

D

Could you ask to be remember I'm.

A

Not yet no I've just been in participating and seeing if it's a fit for me and I, think it is right, yeah like to do it well.

D

When you decided to fit I'm sure there'll be nothing but positive response that awesome, cool um okay, so it sounded like Aaron, would maybe be put together some slides, but he wanted to know a little bit more and I think he's traveling this week. Yeah.

B

D

I think that's I, don't know if there's much more just today but I'll add some notes in the meeting notes. So.

D

C

D

D

D

um Anything more to say about the collab summit, then Michael jiminy, additional comments is that you.

C

Know I think the only other thing is somebody else. I forget off the top. My head is proposing a session, so I think you know if we just have the things that we'd like to cover and it'll, probably already yeah.

D

There's a link from that issue. I think he had a slightly different well, there's some overlap. Definitely up. He also is a little bit interested in kind of the user space, sandboxing, api's understanding.

C

Rescue, yes, I think that's worth discussing as well. Well, it's.

D

Bradley met gonna meet him, I haven't.

C

Heard one way or the other.

D

I might have some time to look at those api's before they assemble. Nobody else steps up, but maybe I could put together these.

C

Yeah, that would be good one.

D

D

He has been working as well.

D

D

D

um Survive on that that yep Lakshmi I'll disclosure guidelines, so that some that is issue 505, there's some people discovered. The number of issues relating to Reggie Jackson's sounds like yeah. Sorry, take it back buffer instructors.

D

So I guess leerin I think was talking up yeah. He was talking about this offline, but evens isn't in this column you think neither is liran I. Think. From that perspective, we we have to hear from them on how that's going though one other thing I would add is I.

D

Is that um I opened a PR, a work-in-progress PR to up the pressure on buffer constructor users by by actually removing the API in in node.js, so your code will will actually just will actually just throw a period that won't be able to use those buffer constructors I did in a way so there's it's possible to revert. There's a revert security command-line option to note that we use mostly in alts. If we have to introduce a security fix that might actually break existing users, it gives them the opportunity to be like ok, I know.

D

This is not good. That I am going to read, you know, get rid of the security like so many hatred, it's I know it's controversial and people very much don't want to break the ecosystems. I'm, not I'm, not like gonna, be pushing this PR really hard. But, given that this, we are continually bringing up that there are many many issues of leave us. There might be a flood of bug reports on them coming soon.

D

If anybody in the security working group has an opinion on whether or not we should actually start whether these problems are serious enough, that we should actually remove the API and force people to opt in at the runtime level to allow this insecure usages should probably comment on that. Pr thankful.

C

Yeah I've discussed it pretty much every meet on the TFC with for the last number of releases with the decision not to do it, but so yeah.

D

Even though even with the CV over was there, it was there a discussion of doing it in a way that was revert of all explosively. That.

C

May be different! That may be new from the previous one, so that that we'll see, if that has a different impact.

D

It's hard to it's hard to commit to taking something out and actually breaking people in a way that they have no way to work.

C

D

C

By sub dependency,.

D

That they don't control I I, very much intend pathetic to why we wouldn't have decided to do that. The.

C

Other wrong I've mentioned a few times, but nobody's really picked up on or thought it's a great idea was if we had some sort.

D

C

In to the most secure like, like you know, strict or something like that, and then you turn on things like this under strict.

D

Yeah, we kind of a softer partial way, I my experiences that people don't opt into that kind of stuff that just yeah. It's like the the CLI options that make all deprecations become runtime errors. If anybody has like on earth, has actually typed that in very.

C

D

Or even development process, I mean out by them a case of beer I. Just don't think anybody I.

C

Could see like company so saying you must run in this mode? Yes,.

D

But we work with big companies and none of them I I, don't know anybody a good company even knows it exists. Yeah the.

A

Experience I've had with that is like in an ideal world. Yes, the people who are I, don't I I was initially gonna reach for smart-mouth, but that's not the night descriptor. um The people who are knowledgeable enough about node to do that already are not like, are already taking care of the things they need to take care of, and the people who aren't knowledgeable or the companies of aren't knowledgeable enough about.

B

A

Won't know about that and they're the ones that will reach it out, but they're, not the ones who will know about that and they're also not going to be able to manage when that breaks things right.

C

A

C

No easy way for me to like this: this revert will give. You is kind of the same thing that.

B

C

Turns it on, and you can say: oh I can turn it off right, yeah yeah, at least it gives you the option of saying I want to force this. So it's like. No, you know you could similarly say. No. You can't have this today, there's no way to sort of find out. If you have problems or not yeah and I think it's.

A

I mean once you get errors, though cuz one bet throw or not throw, but I want that login error, it'll.

C

Throw over this this at least gives you a way where, like internally say, these are the flags when you can't run with right yeah, and you can start to see so by default. You'll get it I. Think today, a part of it is there's, nothing is like say as a deployer. So if you're in charge of deploying the old versus the developer, there's not really.

B

A way where you force.

C

Or even know that you know things are being done, that you prefer weren't right, yeah.

A

And I think that's part of why the III like the approach Sam book, because it puts that burden on the developer, to make sure that their code will work rather than on the person deploying if that makes sense. Yeah.

C

A

C

The flag, or else you're, not gonna, right I'll, be interesting. You could just.

A

Fix a discussion.

C

A

D

Sure so I wonder if I Michael I could do another PR. This would be like a one-line PR yeah.

B

D

The way the deprecations currently work, I mentioned this in my in my last PR. Is it the only show up if the buffer is being used in your top level? Rico, and in other words, if you there's some utility package and when you do your test and BM tasks to work with it, you're gonna see it, but everybody who consumes it doesn't see the deprecation morning. Well,.

C

They don't really you're using deprecated.

D

C

D

The theory that since they don't need, since they can't actually change it, then why show them yeah, but actually, when you put deprecation warnings that say things like security into people's face, they go back and open issues on those sub dependencies and put pressure, sometimes in a not very nice way. Yeah yeah then, and that's unfortunate, but anyhow they they put pressure. So we we could also just like slightly up the pressure by removing that opt out. So suddenly, deprecations are gonna, start work showing up, but like probably possibly all over the place. I think.

D

Last time we did that deprecation showed up when people used NPM I, think that is a little bit too much right. Those.

C

Things it's like. Yes, you can open issues, but then yeah.

C

That's why that's why the one that similar is it was like: okay, here's a compromise which only deprecated at the top level, so.

A

I guess an alternative approach is, you know, I know, chakra has done some work, I mean not alternative, but additional approach. I know chocolate is done, not a lot of work on figuring out modules. They use this and the most impactful modules I can dedicate some time to going through in submitting yards to those modules just to change that usage.

A

I've done it before, and it's relatively simple, like it's a very simple change: it shouldn't be hard to review, shouldn't be hard to do I ain't, and so at that point you either get to our merge. Where you get the person to tell you to go away, which will, let us know, ecosystem impact of like if this person's telling us to go away. I'm gonna use this new API, which yeah that could happen.

A

We will know okay well, this module is going to be impacted and every single user will be facing this because they don't want to change this API all right, so I figured that's a good way. Instead of kind of doing it like after the fact kind of going in being proactive might be.

C

Yeah, definitely people have have taken several rounds.

A

Of submitting PRS.

D

I guess it sounds like it's still.

C

There's more and more for some reason: oh well.

D

I, don't think more and more I think so I haven't looked at it, I, don't know if I've seen the list I could probably go find it I think I think I could find it, but I haven't actually looked at the list of packages that have this issue.

D

I suspect what it is is that there's a very, very long tail like a whole bunch of modules, possibly possibly thousands of modules that are not used very often and don't get updated very often or at all, and are just kind of sitting there with this insecure usage, but.

C

That the report is I'm, pretty sure, is that the numbers are going up. The number of modules are going up that have this problem. Not down is.

A

It the number of modules or the number of downloads, and also is that, is it topical modules or is it in their dependency tree I'd.

C

Have to go, look, you know, III think the message was is like it's not tailing off, as we were hoping yeah.

B

D

Thought it was the same kind of level. Ish I didn't realize it was going up, but I think Tony brings up a good point. I mean actual downloads might go up, even though the number of packages remains exactly the same. It's just sure, but.

C

That would be, that would be understandable.

C

I I mean I think there is a move to move the data out into the public. It's out, I believe, oh, no, it's not it's not so I think that's! If that data becomes in the regular repo, then we can look at that, and I can also make a blog post.

A

About that as well and.

D

Once it was public, it would also I mean as another kind of soft thing. We could also point people to it and say: hey anybody wanting to PR these walks. You know if you.

C

Use it right job.

D

You know, take a look through it look at your own dependency tree and ask yourself, you know yeah.

C

D

Certainly something we've.

C

Talked about in the package, maybe it's something that we could focus on.

C

So yeah just you'll, see, there's there'll be a lot of discussion on that one I'm sure yeah.

D

Okay, well, I mean I, think we print some released visit, there's a bunch of like I. Don't think we should do do nothing. I think we need to in some way increase the pressure if any of these things like, if we don't continually try to do a little bit more. This problem.

C

Is not going to go.

D

Away, it's not by itself and one of these days there might be an actual live exploit in a circumstance where people care about and then we'll have another.

D

C

I agree: it's finding out, like the next incremental step that can be done. Like Anna came up with that one where it's like. Okay at the top level, that's going to you know, fly and got in, and it's like. What's the next bit that makes it.

A

Yeah and I mean I'm looking at the repo right now and I. Think there's a lot of good in there.

A

Making that more obvious and making it.

A

Less noisy, I guess like the signal-to-noise of like what do I actually need to look at in this repo. That would help more people come and do this or like people realize oh yeah. This is a my dependency tree. Also just give them a line of code around you know, do NPM, LS and then whatever module, that gives them a way to kind of hand, hold them along, seeing if their code is actually yeah.

C

There was even discussion in the package maintenance team of like. Could we build a tool which would.

A

C

The PRS I mean.

B

That yeah, they should have got.

C

B

C

Generate the PRS that would fix that, would basically, you know: scanner scanner, repoing, fine issues of bunker generated PR that replaces the usage yeah.

C

Or or even if you know, it's not possible to fully automate it that sort of help, somebody who wants to help with the module dry, it's like I.

B

Think a long line, I'm saying.

C

Not just a written like here's, some system for the steps, but a tool that would help assistance, yeah.

D

Also, if we post another blog post, maybe we can make it clear that, like there's a way to automatically scan your, if you turn on the deprecation, you I think you can turn on the deprecation water.

D

After look at that, I, don't know if there's a way that you can set an environment variable to turn on the deprecation warning and then run your tests and see if it triggers anything that any of your sub dependencies, in other words, I, don't know if the opt-out is so strong. You can't get rid of the opt-out that might make a difference. Allow people to just see okay. Does this affect me or not? Or is it just a bunch of no can't can't give generation packages on NPM? Guess that I don't care right.

C

D

I, don't know, as I want to say on that topic that we need is the ground for now. No.

C

I think you know the your pure will I mean I. Think there's some other ones as well, but it'll probably have some more discussion and then you know we think we need to do something. As a security working group, we need to figure out like okay, what are the what steps, or is it like, encouraging people to help update buffer? You know whatever would be good to say here. The concrete next steps that we.

D

Okay, um it's pretty working okay, so I think I. Think for that thing the the next issue alone would be issue 504, which is we just talk about this? We just talked about it. There twice.

C

This is a presentation for note. Come from you.

D

O-5 Canyon, oh sorry, a different time. ah This is no company.

C

E

Then we have a medium.

C

Here to dive into that no more depth, alright,.

D

This we could ask, is there anybody here? Who is definitely going to knock on for you? So fine I, don't I, don't know if I am NOT. Definitely.

D

He'll be likely read.

C

Again, I'm hoping, but.

B

C

Is tilt so is still pretty far.

A

I'm, even knowing big days, if I'm, honest I just know it's coming, I think.

C

It's the Ripper.

D

Okay, well maybe we should leave that for now, then.

D

Okay and then my reading, the bone builders database into its own repo I mean nobody is working. That I think is here, but we do need to discuss it more as it appears to be going on progressing well. Thank.

C

You so much for anybody who's watching one. Why it's there.

D

C

Who's watching and using the database just be aware, you know, new new ones will only start going into the new database, starting in a few days and next month, it'll be remove.

A

Additionally, I know wherever time so I just want to mention there that if either of you have time, please kick out that meet you see if I can find it insecurities about indices, sorry to keep going on, but indexes but I care about them. 521 security working group.

D

A

Don't have to go over it now, just stir six y'all it's time but I. Just if you could take a look at it. Stellar is.

D

This thing about keeping the existing indexes so.

A

This is about putting automating indices, I I kind of went out about this out of order. I created a PR before creating that you I totally spaced that I said I'd create an issue first, but yeah, basically maintaining indices in the other people's security advisories repo, the one we're just talking about, so people can programmatically course them. um There's also I've also suggested in a complacent. I really didn't do it in this issue. I can do that now.

A

This could perhaps they could perhaps live on no Jaidev until you know, as part of that workflow, instead of being put up into the current website, just to kind of release them with that when it becomes the official website and also to have them online in a place that people know they can reach them. So you know, but also not saying this is an official thing immediately.

A

C

Can't make sense yeah the mean. The main thing for me is just that we get the group here to say yeah we commit to maintaining these because I think once they're there I will be depending on them and it's another piece of the data, though it's just getting enough people to say: hey, that's a good idea and we'll make it a priority to keep them going. Yeah absolutely.

A

Yeah yeah: that's just why I wanted to bring that up just to get I've done. It.

D

D

Does anybody have the YouTube channel open I closed it because it was? Can we keep that I give me what is there any um any public questions.

A

It doesn't know just someone sing hello, okay,.

D

Hello to you to someone.

D

Okay, so that's the Q&A and other I guess yeah.

C

D

Think I think that's it. Then. Okay.

B

C

Talk to everybody later, okay,.

D

Thank you for showing up like any pain. Don't you see.