Notes for June 6

Author: rcthomas

meetings/2023-06-06.md

@@ -0,0 +1,56 @@
+# Jupyter Security Bi-weekly Meeting
+
+## June 6, 2023
+
+| Name               | affiliation    | username         |
+| -------------------| ---------------|------------------|
+| Matthias Bussonnier| Quansight      | @carreau         |
+| Rick Wagner        |  UCSD          | @rpwagner        |
+| Jason Weill        | @AWS           | @JasonWeill      |
+| Joe Lucas          | NVIDIA         | @josephtlucas    |
+| Rollin Thomas      | NERSC          | @rcthomas        |
+| Cory Sherman       | U of Wisconsin |.                 |
+
+* Thoughts from JupyterCon (10 minutes)
+    * Security tutorial
+    * Joe's excellent demo talk on security
+    *  - Have helpers do a time check
+         - 30 -> 15 -> 10 decrease Attendees.
+         - Notebook trust
+             - OAuth OIDC with pyiodide.
+             - Stack of the interpreter persistence state timeline ? 
+* Asset inventory and documenting privileged accounts (30 minutes)
+    * Related topics:
+        * [Domain name management](https://github.com/jupyter/security/issues/64) for both `mybinder.org` and [`jupyter.org` subdomains](https://github.com/jupyter/enhancement-proposals/blob/master/jupyter-subdomain-for-schemas/proposal.md) (and ipython.org cf cve for mail?)
+        * [PyPI org](https://github.com/jupyter/security/issues/61#issuecomment-1526251886)
+            * Matthias:  Multiple small issues with orgs that might need to likely eb resolved first.
+    * Suggested process (Rick):
+        * Draft asset table in private repo
+        * Host a series of short office hours and invite various subprojects, asset owners and managers to contribute
+        * Define who should have 1Password accounts to help be a known resource, designees from the Security Subproject, designees from the SSC or EC?
+        * Another world tour to share encourage participation?
+* Jupyter Security Community Meeting, **Oct 24-26** (10 minutes)
+    * [2023 NSF Cybersecurity Summit CFP](https://www.trustedci.org/2023-cfp) is out
+    * Email from Jim Marsteller:
+        * The deadline for submitting proposals is **Friday June 16, 2023.**
+        * We hope to have the Jupyter project participating at the summit this year.
+        * I believe a full day of training was discussed earlier with a possible collaboration with Zeek on interoperability between the two projects.
+        * I just sent a similar email to the Zeek folks to make them aware.
+    * Possibly straightforward to get a day
+    * Current schedule unclear (will it be Monday, Friday?)
+    * Hoping for a not Monday or Friday
+    * Proposal:
+        * Security workshop proposal from Rick independently
+        * For the summit itself or Jupyter workshop
+            * Who'd be at the summit anyway to draw in Jupyter folks?
+    * NSF encourages hybrid workshops
+        * "Workshop and training organizers may choose to offer either in-person or a hybrid model to include attendees joining remotely via Zoom. Workshop/training organizers are encouraged to offer hybrid sessions to maximize participation. This includes running the Zoom (e.g., monitoring the chat, unmuting remote participants, etc.). "
+
+* ipython.org SPF vulnerability
+    - name.com point to DNS on cloudflare. I modified ~all to -all waiting for DNS propagating.
+        - DNS has propagated for me.
+
+* Other topics (10 minutes)
+    * Draft a security FAQ based on recent emails?
+    * Intigriti Bug Bounty: project descriptions need to be updated
+        * Follow up with Charlotte