Improving the Security of a Large Open Source Project One Step at a Time
summary
Node.js security working group secures core with OpenSSF funding, uses HackerOne for private reports, a private repo for fixes, and an eight‑to‑nine‑person triage rotation; CVE scoring gets tuned to avoid false alarms. Security releases follow a 26-step security release process with rotating company-backed release stewards; automation work consumes ~700 hours so far. Proactive moves include dependency scanning, an OSSF scorecard (about 7.3/10), and the experimental Node 20 permissions model. A Windows providers.dll case (calculator executed on npm activity) drives platform-specific fixes.
AI-written summary · about
chapters (7)
- 0:00Start
- 0:25Michael Dawson
- 1:55Overview
- 9:01Threat Model - examples
- 24:45Being Proactive: Dependency Vulnerability Checks
- 30:32Being Proactive: Automated dependency updates
- 32:32Automating security release process
related talks
48mImproving the Security of a Large Open Source Project One Step at a Time- 48mImproving the Security of a Large Open Source Project One Step...
27mPanel: Building A Secure Ecosystem for Node.js
36mOpenJS and Security Updates with Community Panel- 36mOpenJS and Security Updates...
44mSecuring Open Source Software - End-to-End, at Massive Scale, Together
27mState of Node.js Security
41mBack to Security Basics: Evaluating, Consuming, and Contributing Open Source...