Moving from our CNA to OpenJS CNA

[RafaelGSS]

As recently announced by OpenJS, they now own their CNA.

I have been talking with @ruddermann over the past month about the possibility of including Node.js in the OpenJS CNA umbrella. As stated by @mcollina in the TSC channel

We are a CNA only as a defensive measure to have the final say. I trust OpenJS to be a good CNA.

I feel it would be great to fold in their CNA as well. Nothing should change from our security release process or in the automation.

[mcollina]

@RafaelGSS are you sure? How will we request the CVE?

[marco-ippolito]

I'm afraid the whole automation with H1 apis will stop working

[mhdawson]

It really does not cost us much to have our own CNA so I'm not sure its worth making a change immediately. We might see how the foundation manages being a CNA for the other projects for a little while and if we see benefits from what is being done that would help us move over then.

[mcollina]

If so it would be better to start issuing our own CVEs instead of relying on H1.

[marco-ippolito]

I'd be cautious with changing CNA, I'd wait a few months and figure out a few things (also technical details like how to automate the cve lifecycle).
There is no rush for us so I'm in favor of moving but not right now

[ruddermann]

Sorry if there was confusion on this, but being in the OpenJS CNA's scope doesn't force you to stop using the H1 API. You're already in the scope of your own CNA and using the H1 API.

The OpenJS CNA will soon have an API token to request CVE IDs and publish/update those CVEs IDs and there are standard tools like cvelib from Red Hat that the CNA can use to automate and control the entire end-to-end CVE process.

Y'all have a lot of experience with this kind of automation already. It'd be awesome to have Node.js folks advise on this so the OpenJS CNA can provide a service that is easy and straightforward for you to leverage. But it is not a requirement to be under the OpenJS CNA.

[RafaelGSS]

@ruddermann, what would we need to do in order to be in the OpenJS CNA scope? Can we keep using HackerOne and its API?

Meanwhile, I leave this issue open, but remove it from the TSC agenda so we can discuss it asynchronously.

[jasnell]

Are there concrete next steps here or is this left open just to allow for discussion? It's not clear.

[RafaelGSS]

We are still discussing it on the OpenJS Security Collab space. I'll bring more details once I have them.

[jasnell]

Still no concrete updates here?

[RafaelGSS]

Not really. The OpenJS CNA exists (I'm part of it), but we didn't feel the need to move it. At the moment, holding our own CNA didn't create any issues, considering the CVE request is being handled by H1.