add third party vuln process #57

vdeturckheim · 2017-10-22T14:15:03Z

Workflow as decided in #54

cjihrig · 2017-10-23T14:01:54Z

processes/third_party_vuln_process.md

@@ -0,0 +1,86 @@
+This document describes the management of vulnerabilities within the Node.js
+ecosystem. Vulneabilities in Node.js core are out of this scope.


Vulneabilities -> Vulnerabilities

cjihrig · 2017-10-23T14:02:36Z

processes/third_party_vuln_process.md

+# Definitions
+
+* package: in this document, a package is a module available widely to use 
+with Node.js.Most modules are hosted on npmjs.org repository. 


Space after Node.js. Also add "the" before npmjs.org.

cjihrig · 2017-10-23T14:02:49Z

processes/third_party_vuln_process.md

+
+# Process
+
+Individuals who found potential vulnerabilities in a package are invited 


found -> find

cjihrig · 2017-10-23T14:03:16Z

processes/third_party_vuln_process.md

+# Process
+
+Individuals who found potential vulnerabilities in a package are invited 
+to fill a vulnerability report on the dedicated HackerOne organization:


fill -> complete

cjihrig · 2017-10-23T14:03:34Z

processes/third_party_vuln_process.md

+
+[https://hackerone.com/nodesecurity](https://hackerone.com/nodesecurity)
+
+When a potential vulnerability is reported, the following actions are taken


Add a colon after taken.

cjihrig · 2017-10-23T14:04:38Z

processes/third_party_vuln_process.md

+
+**Delay:** 48 hours
+
+Within 72 hours, a member of the triage team provides a first answer to the 


Is the turnaround time 48 or 72 hours?

🤦‍♂️

cjihrig · 2017-10-23T14:05:04Z

processes/third_party_vuln_process.md

+individual who submitted the potential vulnerability. The possible responses 
+can be:
+
+* acceptation: what was reported is considered as a new vulnerability


acceptation -> Acceptance

cjihrig · 2017-10-23T14:07:16Z

processes/third_party_vuln_process.md

+## Case of vulnerabilities found outside this process
+
+Vulnerabilities found and fixed outside this process should be added into
+the vulnerability base. This can be done by anyon through a Pull Request on 


anyon -> anyone

Thanks for the review!

vdeturckheim · 2017-10-23T17:33:01Z

processes/third_party_vuln_process.md

@@ -0,0 +1,86 @@
+This document describes the management of vulnerabilities within the Node.js
+ecosystem. Vulnerabilities in Node.js core are out of this scope.


Saying that, we will end up collecting vulnerabilities for Front-end packages.

Perhaps link here to https://nodejs.org/en/security/ or something like that?

the nsp database includes a couple front-end packages, as does snyk's database. There are lots of FE code distributed via npmjs.org. Node "app" developers (or users of those apps when they are insecure) don't necessarily distinguish between a "vuln in js code evaluated by node" and "vuln in js code served by node to a FE, and evaluated by a web browser". We need to be really clear, though, on what the scope is if the DB managed by the Node Foundation. Is it packages in npmjs.org? Or, is it node javascript packages (no matter where accessed from)? Both?

We historically considered anything within npm to be in scope for what to include in our ecosystem initiative.

vdeturckheim · 2017-10-23T20:19:31Z

processes/third_party_vuln_process.md

+the vulnerability base. This can be done by anyone through a Pull Request on 
+this repository.
+
+# The triage team


Need to add a part discussing NDA

Once #56 lands, the team membership and NDA can be shared.

bengl

Who manages the HackerOne org should be mentined (i.e. this WG).

bengl · 2017-10-23T20:20:53Z

processes/third_party_vuln_process.md

@@ -0,0 +1,86 @@
+This document describes the management of vulnerabilities within the Node.js
+ecosystem. Vulnerabilities in Node.js core are out of this scope.


Perhaps link here to https://nodejs.org/en/security/ or something like that?

bengl · 2017-10-23T20:22:46Z

processes/third_party_vuln_process.md

+**Delay:** 45 days
+
+When a vulnerability is confirmed, a member of the triage is 
+designated as follow up on this topic.


designated to follow up is clearer I think.

bengl · 2017-10-23T20:24:16Z

processes/third_party_vuln_process.md

+
+Within 45 days after the triage date, the vulnerability must be made public.
+
+If a patch is being developed by the package maintainer, a delay of 30 days 


being developed -> being actively developed

bengl · 2017-10-23T20:26:11Z

processes/third_party_vuln_process.md

+
+Within HackerOne, this is handled through a "public disclosure request".
+
+## Case of vulnerabilities found outside this process


Case of vulnerabilities -> Vulnerabilities

jasnell · 2017-10-23T20:32:55Z

processes/third_party_vuln_process.md

+
+## Triage
+
+**Who:** The triage team


should this list who the members of the triage team are? I assume this is made up of the current recipients of the security@ messages?

Or is this specifically only for module vulnerabilities?

@jasnell This is a separate group for triage of non-core vulnerabilities.

once #56 lands, this PR can also include addition of a Team to the doc describing privacy policy, because the same privacy policy should apply to thirdparty vulns as to core (I think)

sam-github · 2017-10-24T17:00:16Z

processes/third_party_vuln_process.md

+
+Individuals who find potential vulnerabilities in a package are invited 
+to complete a vulnerability report on the dedicated HackerOne organization:
+


It should also be possible for a vulnerability to be reported via email (which can be forwarded to HackerOne and will auto-create a vuln report).

I have an issue on setting up this on H1 side right now. I have pinged H1 on that for assistance.

sam-github · 2017-10-24T17:01:31Z

processes/third_party_vuln_process.md

+
+## Triage
+
+**Who:** The triage team


once #56 lands, this PR can also include addition of a Team to the doc describing privacy policy, because the same privacy policy should apply to thirdparty vulns as to core (I think)

sam-github · 2017-10-24T17:07:14Z

processes/third_party_vuln_process.md

+
+Within 45 days after the triage date, the vulnerability must be made public.
+
+If a patch is being developed by the package maintainer, a delay of 30 days 


do we have to be so specific about the 30 days? Can we make it more wish-washy, something like "by majority agreement and sole discretion of the triage team, publicization may be delayed. This will only be done if there is some clear proposal for a timeline for publicization, and justification for the delay."? This basically allows the triage team to "do the right thing" under unusual situations, rather than being bound to overly strict rules.

sam-github · 2017-10-24T17:07:46Z

processes/third_party_vuln_process.md

+the vulnerability base. This can be done by anyone through a Pull Request on 
+this repository.
+
+# The triage team


Once #56 lands, the team membership and NDA can be shared.

mhdawson · 2017-11-03T14:04:45Z

processes/third_party_vuln_process.md

+
+# Definitions
+
+* package: in this document, a package is a module available widely to use 


I'd suggest

a package available for use with Node.js and hosted on the npmjs.org repository.

mhdawson · 2017-11-03T14:06:40Z

processes/third_party_vuln_process.md

+* Acceptance: what was reported is considered as a new vulnerability
+* Rejection: what was reported is not considered as a new vulnerability
+* Need more information: the triage team needs more information in order to
+evaluate what was reported.


Need to be lined up with Need for proper markdown formatting.

mhdawson · 2017-11-03T14:07:05Z

processes/third_party_vuln_process.md

+
+**Delay:** 45 days
+
+When a vulnerability is confirmed, a member of the triage is


triage -> triage team

mhdawson · 2017-11-03T14:07:16Z

processes/third_party_vuln_process.md

+**Delay:** 45 days
+
+When a vulnerability is confirmed, a member of the triage is
+designated to follow up on this topic.


topic -> report

mhdawson · 2017-11-03T14:08:04Z

processes/third_party_vuln_process.md

+## Vulnerabilities found outside this process
+
+Vulnerabilities found and fixed outside this process should be added into
+the vulnerability base. This can be done by anyone through a Pull Request on 


base -> database

mhdawson · 2017-11-03T14:09:07Z

processes/third_party_vuln_process.md

+
+# The triage team
+
+The triage team is composed of 7 to 10 members of the security working group.


Do we need a number here ? May be better to just leave it up to the security wg team to decide when people volunteer.

Some stated floor for the minimal number has value to me that at least expresses the intent to ensure that this is not a role that can be distilled down to an individual or lesser number who feel they can/should take it on alone. Not sure how binding this is as a process doc vs. a charter for the group which is where that would ideally be documented, but I don't think that exists atm.

A minimum number would not be a concern for me. I was more worried about when we hit X and then somebody volunteers.... Probably a good problem to have. Maybe we say something like composed of Y or more members ..

mhdawson · 2017-11-23T17:15:55Z

Overall looks good to me. We just need to fill in the email address and ensure the hackerone org is active before landing.

vdeturckheim · 2017-11-30T13:29:48Z

We can now set up email alias to our H1 org. PR has been opened in the email repo nodejs/email#75

vdeturckheim · 2017-12-07T19:56:41Z

This should be good to merge now, does anyone wants to review one last time?

mhdawson

LGTM

mhdawson · 2017-12-07T23:41:49Z

I see its passed on smartos15 and smartos16, so maybe its just that the versions of Node.js that we are testing don't run on smartos14 and we should just remove that. @cjihrig what is the oldest version of Node.js that runs on smartos 14 ?

cjihrig · 2017-12-08T00:09:02Z

@mhdawson wrong issue?

mhdawson · 2017-12-08T16:13:33Z

@cjihrig yes, will move to right one

cjihrig reviewed Oct 23, 2017

View reviewed changes

vdeturckheim commented Oct 23, 2017

View reviewed changes

bengl reviewed Oct 23, 2017

View reviewed changes

jasnell reviewed Oct 23, 2017

View reviewed changes

sam-github mentioned this pull request Oct 24, 2017

process: describe sec team membership and policy #56

Closed

sam-github reviewed Oct 24, 2017

View reviewed changes

mhdawson reviewed Nov 3, 2017

View reviewed changes

add third party vuln process

9127249

This was referenced Dec 7, 2017

Third party triage team membership #73

Closed

update security policy regarding third party modules nodejs/nodejs.org#1502

Merged

ghost approved these changes Dec 7, 2017

View reviewed changes

mhdawson approved these changes Dec 7, 2017

View reviewed changes

cjihrig mentioned this pull request Dec 8, 2017

CI: SmartOS: SIGABRT while running tests nodejs/node-addon-api#179

Closed

vdeturckheim merged commit 91d3a8b into nodejs:master Dec 8, 2017

vdeturckheim deleted the third_party_vuln_process branch December 8, 2017 09:02

		@@ -0,0 +1,86 @@
		This document describes the management of vulnerabilities within the Node.js
		ecosystem. Vulneabilities in Node.js core are out of this scope.


		# Process

		Individuals who found potential vulnerabilities in a package are invited


		[https://hackerone.com/nodesecurity](https://hackerone.com/nodesecurity)

		When a potential vulnerability is reported, the following actions are taken


		Delay: 48 hours

		Within 72 hours, a member of the triage team provides a first answer to the

		@@ -0,0 +1,86 @@
		This document describes the management of vulnerabilities within the Node.js
		ecosystem. Vulnerabilities in Node.js core are out of this scope.


		Within 45 days after the triage date, the vulnerability must be made public.

		If a patch is being developed by the package maintainer, a delay of 30 days


		Within HackerOne, this is handled through a "public disclosure request".

		## Case of vulnerabilities found outside this process


		Individuals who find potential vulnerabilities in a package are invited
		to complete a vulnerability report on the dedicated HackerOne organization:


		# Definitions

		* package: in this document, a package is a module available widely to use


		Delay: 45 days

		When a vulnerability is confirmed, a member of the triage is


		# The triage team

		The triage team is composed of 7 to 10 members of the security working group.

add third party vuln process #57

add third party vuln process #57

Conversation

vdeturckheim commented Oct 22, 2017 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

bengl left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mhdawson commented Nov 23, 2017

vdeturckheim commented Nov 30, 2017

vdeturckheim commented Dec 7, 2017

mhdawson left a comment

Choose a reason for hiding this comment

mhdawson commented Dec 7, 2017

cjihrig commented Dec 8, 2017

mhdawson commented Dec 8, 2017

vdeturckheim commented Oct 22, 2017 •

edited

Loading