Skip to content

Commit 36b5b3d

Browse files
CarreauCarreau
authored
Merge pull request #74 from jupyter/2024-meeting-notes-catchup
Adding notes from previous meetings
2 parents 6576ac4 + bbf8009 commit 36b5b3d

12 files changed

+303
-1
lines changed

‎meetings/2023-08-15.md

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
# Jupyter Security Bi-weekly Meeting
2+
3+
## Auguest 15, 2023
4+
5+
| Name | affiliation | username |
6+
| -------------------| ---------------|------------------|
7+
| Matthias Bussonnier| Quansight | @Carreau |
8+
| Jason Weill | @AWS | @JasonWeill |
9+
| Joe Lucas | NVIDIA | @josephtlucas |
10+
| Michał Krassowski | Quansight | @krassowski |
11+
| Eric Gentry | Anaconda | @ericsnekbytes |
12+
13+
14+
* Intigrity – Some security bugs, and a few difficulties to sync with GitHub
15+
* How to increase email volume?
16+
* Permissions not sync'ed across GitHub organizations (requires GH Enterprise?)
17+
* How can we handle this better.
18+
* Mike pointed out security managers:
19+
https://docs.github.com/en/rest/orgs/security-managers?apiVersion=2022-11-28
20+
https://docs.github.com/en/organizations/managing-peoples-access-to-your-organization-with-roles/managing-security-managers-in-your-organization
21+
https://github.blog/changelog/2021-10-21-introducing-the-organization-level-security-manager-role/
22+
* Matthias opened an issue about it : https://github.com/jupyter/security/issues/68
23+
24+
* Numfocus tidelift money
25+
* Still waiting to make sure we do recive it and have regular update on the ammount.
26+
* Numfocus summit in amsterdam
27+
* speak about security.
28+
29+
* confusion between [email protected] and [email protected]
30+
* Turn on moderation ?
31+
* Seem we have agreement.

‎meetings/2023-09-05.md

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
# Jupyter Security Bi-weekly Meeting
2+
3+
## September 5, 2023
4+
5+
| Name | affiliation | username |
6+
| -------------------| ---------------|---------------|
7+
| Matthias Bussonnier| Quansight | @Carreau |
8+
| Jason Weill | @AWS | @JasonWeill |
9+
| Joe Lucas | NVIDIA | @josephtlucas |
10+
| Rick Wagner | UCSD | @rpwagner |
11+
| Rollin Thomas | NERSC | @rcthomas |
12+
13+
* TrustedCI Summit Plans
14+
* Jupyter security tutorial, Monday, October 23
15+
* Jupyter network monitoring workshop, Tuesday, October 24
16+
17+
18+
6 out of 13 vuln accepted on Integrity. Small to large.
19+
Should we say how much it cost ? Would other Bug BOunty
20+
21+
- Should there be a Numfocus BugBounty program ?
22+
- $14000 left in the project
23+
- Foobar 7/13
24+
25+
## Tidelift Money
26+
27+
|Date| project| amount (USD)
28+
|----| -------|---------
29+
|10/06/22|conda/ipython |250.00
30+
|10/06/22|pypi/ipython |250.00
31+
|10/06/22|conda/traitlets |250.00
32+
|10/06/22|pypi/traitlets |100.00
33+
|12/21/22|Tidelift Payout Nov & Dec 2022 (iPython) |1,000.00
34+
|12/21/22|Tidelift Payout Nov & Dec 2022 (Traitlets) |700.00
35+
|3/08/2023|Traitlets February 2023 |350.00
36+
|3/08/2023|iPython February 2023 |500.00
37+
|3/08/2023|Traitlets January 2023 |350.00
38+
|3/08/2023|iPython January 2023 |500.00
39+
|4/21/2023|Traitlets March 2023 |350.00
40+
|4/21/2023|iPython March 2023 |500.00
41+
|5/15/2023|Traitlets April 2023 |350.00
42+
|5/15/2023|iPython April 2023 |500.00
43+
|6/13/2023|iPython May 2023 |500.00
44+
|6/13/2023|Traitlets May 2023 |350.00
45+
|$ 6,800.00

‎meetings/2023-09-19.md

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
# Jupyter Security Bi-weekly Meeting
2+
3+
## September 19, 2023
4+
5+
| Name | affiliation | username |
6+
| -------------------| ------------|--------------|
7+
| Matthias Bussonnier| Quansight | @Carreau |
8+
| Joe Lucas | NVIDIA | @josephtlucas|
9+
| Rick Wagner | UCSD | @rpwagner |
10+
| Jason Weill | @AWS | @JasonWeill |
11+
| Rosio Reyes | Anaconda | @RRosio |
12+
13+
* Matthias may see if Juanita can attend the TrustedCI workshop
14+
* She says yes, she is interested, she live in Santa Cruz, can drive, and can figure out lodging. Just need to get her a ticket.
15+
* Rosio wants to learn more about vulnerability reporting/handling process
16+
* Issue opened up a couple of weeks ago when someone wants to report a vuln
17+
* Revised TrustedCI blog post
18+
* Intigriti
19+
* Will probably close it out with a blog post
20+
* With a quote from Charlotte (Jason W to follow up w/Charlotte)
21+
* Should we involve NF ?

‎meetings/2023-10-03.md

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
# Jupyter Security Bi-weekly Meeting
2+
3+
## October 3, 2023
4+
5+
| Name | affiliation| username |
6+
| -------------------| -----------|-------------|
7+
| Matthias Bussonnier| Quansight | @Carreau |
8+
| Rick Wagner | UCSD | @rpwagner |
9+
| Jason Weill | @AWS | @JasonWeill |
10+
| David Qiu | @AWS | @dlqqq |
11+
| Rollin Thomas | NERSC | @rcthomas |
12+
| Rosio Reyes | Anaconda | @RRosio |
13+
14+
Agenda:
15+
16+
* Email from the Community Building Group:
17+
- Process to source input from subprojects to identify area were help is needed to maintain a robust community. Identifi Commmunity building practices. There are interview scripts, and invite to join calls on thursday.
18+
- Some of us are going to attend on October 19th.
19+
20+
* We know have an Jupyter Security Sandbox environment.
21+
* It will likely be used for the Jupyter/Zeek workshop on Octover 223rd
22+
* The NSF has a program called [CloudBank](https://www.cloudbank.org/). Targetted for cyberinfra and DS. But also grants for training activities.
23+
* It does allow federated logging.
24+
* currently $2k
25+
* Suggest to have this as public information,
26+
* And let the SSC know.
27+
* See https://github.com/jupyter/executive-council-team-compass/issues/13
28+
29+
Sorry I think I ended the meeting for all... not sure how as I should not have been admin ...

‎meetings/2023-10-17.md

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
# Jupyter Security Bi-weekly Meeting
2+
3+
## October 17, 2023
4+
5+
| Name | affiliation| username |
6+
| -------------------| -----------|-------------|
7+
| Rick Wagner | UCSD | @rpwagner |
8+
| Jason Weill | @AWS | @JasonWeill |
9+
| Joe Lucas | NVIDIA | @josephtlucas|
10+
| Rollin Thomas | NERSC | @rcthomas |
11+
| Rosio Reyes | Anaconda | @RRosio |
12+
13+
* Review vulnerability handling process.
14+
15+
* [Workshop agenda](https://docs.google.com/document/d/1hl1qe72s1CZc7Z3QOh1apANRi--qkupcnWEyH4VNOiQ/edit?usp=sharing)
16+
17+
* Jupyter Maint lost devices. Process to remove all access ?
18+
* I (matthias) re-asked to decrease the number of GitHub orgs: [executive-council-team-compass#12](https://github.com/jupyter/executive-council-team-compass/issues/12)
19+
20+
FYI WRT security, matthias suggested a change to handler in Jupyter-Server.
21+
- [jupyter-server/jupyter_server#1332](https://github.com/jupyter-server/jupyter_server/pull/1332)
22+
23+
David not able to attend the community survey this Thursday due to a personal conflict
24+
25+
Charlotte requests that we close accepted submissions in the bug bounty program
26+
* Rick to capture information from submissions, then close
27+
28+
[Trusted CI engagement documentation](https://github.com/jupyter/security/tree/main/docs)
29+
30+
Please add David Qiu to the Jupyter Security (ipython-security) mailing list
31+
* Done (Rick, 10/17/23)

‎meetings/2023-11-07.md

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
# Jupyter Security Bi-weekly Meeting
2+
3+
## November 7, 2023
4+
5+
| Name | affiliation| username |
6+
| -------------------| -----------|--------------|
7+
| Rick Wagner | UCSD | @rpwagner |
8+
| Joe Lucas | NVIDIA | @josephtlucas|
9+
| Rosio Reyes | Anaconda | @RRosio |
10+
| Matthias Bussonnier| Quansight | @Carreau |
11+
| David Qiu | AWS | @dlqqq |
12+
| Rollin Thomas | NERSC | @rcthomas |
13+
14+
15+
- Security reports directly on Jupyter/Security
16+
- HECVAT and alike report:
17+
- See
18+
https://github.com/jupyter/jupyter.github.io/pull/743/files#commit-suggestions
19+
- URL: https://library.educause.edu/resources/2020/4/higher-education-community-vendor-assessment-toolkit
20+
- Attorneys at the NSF summit
21+
- who is the legal entity, do they have attorneys.
22+
- Have both an FAQ, and a Document (pdf) signed by numfocus.
23+
24+
- Opened an [issue (docs-team-compass#22)](https://github.com/jupyter/docs-team-compass/issues/22) for security documentation in the Documentation repo
25+
26+
- David to contribute JupyterLab documentation on developing JupyterLab extensions.
27+
- David: I can get started on this in a few weeks, with a draft PR by early December.
28+
29+
- Security documentation to be added to jupyter.org/security
30+
- Source: https://github.com/jupyter/jupyter.github.io
31+
- Can we have exclusive permissions to edit the "Security" page?
32+
- David's proposed process: We open changes as a draft PR, get feedback from everybody security, then open for review and ping somebody to merge the PR
33+
34+
35+
Matthias suggest a small read later: http://thecodelesscode.com/case/215

‎meetings/2023-11-21.md

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
# Jupyter Security Bi-weekly Meeting
2+
3+
## November 21, 2023
4+
5+
| Name | affiliation| username |
6+
| -------------------| -----------|--------------|
7+
| Matthias Bussonnier| Quansight | @Carreau |
8+
| Joe Lucas | NVIDIA | @josephtlucas|
9+
| Rosio Reyes | Anaconda | @RRosio |
10+
11+
Tasks:
12+
- [ ] Reply to "Pilot: Security Committee Introduction and Survey" and fill in the form.

‎meetings/2023-12-05.md

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
# Jupyter Security Bi-weekly Meeting
2+
3+
## Dec 5th, 2023
4+
5+
| Name | affiliation| username |
6+
| -------------------| -----------|--------------|
7+
| Matthias Bussonnier| Quansight | @Carreau |
8+
| Joe Lucas | NVIDIA | @josephtlucas|
9+
| Rosio Reyes | Anaconda | @RRosio |
10+
| Rick Wagner | UCSD | @rpwagner |
11+
| David Qiu | AWS | @dlqqq |
12+
| Rollin Thomas | NERSC | @rcthomas |
13+
14+
15+
The amount of money in the Tidelift account for Jupyter is close to ~7900 USD. Some funds weere used to reimburse for travel expenses to NSF security Summit.
16+
17+
Some people were sick in the previous week.
18+
19+
Numfocus Security council slowly progressing with a data-baked process.
20+
21+
- Juanita in contact with Open SSF.
22+
- Writing Guides
23+
- Credentials;
24+
- Matthias: https://github.com/scientific-python/specs/pull/168#pullrequestreview-1557436109
25+
26+
- David: Quick update on the labextension documentation that Rick had requested. Hoping to start on this sometime this week, should have something ready by the end of the month. Rather busy right now.
27+
28+
- Matthias, Tidelift: https://github.com/jupyterlab/team-compass/discussions/224
29+
- David: I'll bring this up in the JupyterLab call tomorrow.
30+
31+
- [ ] TODO: Matthias said hw would reach out to NF with list of request for hecvat and similarm but forgot.

‎meetings/2023-12-19.md

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
# Jupyter Security Bi-weekly Meeting
2+
3+
## Dec 19th, 2023
4+
5+
| Name | affiliation| username |
6+
| -------------------| -----------|--------------|
7+
| David Qiu | AWS | @dlqqq |
8+
| Rick Wagner | UCSD | @rpwagner |
9+
10+
- David: Rick proposed refining and outlining the existing security vulnerability process. It would involve a stakeholder from each subproject.
11+
- I suggest that we also have a triage group for this to avoid generating noise. That is, if you receive a notification, it will be very likely that this vulnerability affects your project, and that this demands your attention.
12+
- Rick suggests using GitHub's security vulnerability reporting process. We should investigate 1) when this sends notifications, and 2) who is notified in this process.
13+
- I can help with another draft of the vulnerability reporting process.
14+
- https://github.com/jupyter/security/blob/main/docs/vulnerability-handling.md
15+
16+
- Mike: https://github.com/jupyter/notebook/pull/7153/files
17+
- Cross-linked in security repo: https://github.com/jupyter/security/issues/72
18+
- David: I agree that GH Actions are sort of dangerous by default. But the real problem isn't that we need to hashpin, but that I'm not aware of any tool that helps with this.
19+
20+
- Mike: Perhaps we should invite https://github.com/diogoteles08 to one or our meetings in the future.
21+
- David: I agree with this; let's build a bridge if possible.

‎meetings/2024-01-02.md

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
# Jupyter Security Bi-weekly Meeting
2+
3+
## Jan 2th, 2024
4+
5+
| Name | affiliation| username |
6+
| -------------------| -----------|--------------|
7+
| Joe Lucas | NVIDIA | @josephtlucas|
8+
| Rosio Reyes | Anaconda | @RRosio |
9+
| Dor Sarig | Pillar Security ||
10+
| Ziv | Pillar Security ||
11+
12+
- Rosio to continue working on Threat Modeling for Rosio but has priority conflicts currently.
13+
- Dor/Ziv were following up on a vulnerability reported to [email protected]

0 commit comments

Comments
 (0)