Improving the Security of a Large Open Source Project One Step at a Time
Talkat Open Source Summit Europe 2023 · on Wednesday, 2023-09-20· at 14:40· Room 0C (Floor 0), Abandoibarra Etorb., 4, 48011 Bilbao, Bizkaia, Spain·
summary
Node.js security working group describes concrete changes: OSSF funding pays a dedicated security role and multiplies volunteer effort; a documented threat model guides CVSS decisions; a 4–5 person rotating HackerOne triage team handles private reports and CVE issuance; Node 20 ships an experimental permission model to restrict fs/threads/inspect; a dependency-vulnerability repo plus automated dependency-updates reduce blind spots; a 26-step security-release process uses release stewards but full release automation (one-click buttons) and broader CI coverage remain work in progress.
AI-written summary · about
chapters (17)
- 0:00Node.js security intro
- 1:28Node.js project background
- 4:55Reactive security process
- 8:27Threat model workflow
- 13:22Private security fixes
- 16:31Security release process
- 19:02Proactive security overview
- 20:26Dependency checks automation
- 22:10Node.js permission model
- 25:49Security best practices doc
- 27:37Automate dependency updates
- 29:04OSSF Scorecard & best practices
- 32:58One-click security releases
- 33:59Supply chain security review
- 34:40Individual contributions
- 38:15Organizational support
- 40:43Q&A
related talks
47mImproving the Security of a Large Open Source Project One Step at a Time
48mImproving the Security of a Large Open Source Project One Step...
27mPanel: Building A Secure Ecosystem for Node.js
27mState of Node.js Security
36mOpenJS and Security Updates...
40mResponsible Use of Node.js & Open Source Software Utilizing Best Practices at an...
19mNode Security
49mImproving FOSS Security