Merge pull request #53 from jupyter/notes-2023-01-03

Notes from last week's meeting (Jan 3 2023)

Author: rcthomas

meetings/2023-01-03.md

@@ -0,0 +1,31 @@
+# Jupyter Security Bi-weekly Meeting
+
+## January 3, 2023
+
+| Name               | affiliation| username         |
+| -------------------| -----------| -----------------|
+| Jason Weill        | AWS        | @JasonWeill      |
+| Matthias Bussonnier| Quansight  | @carreau         |
+| Rollin Thomas      | NERSC      | @rcthomas        |
+| Sritej Attaluri    | Bloomberg  | @attaluris       |
+| Rick Wagner        | UCSD       | @rpwagner        |
+| Jason Grout        | Databricks | @jasongrout      |
+
+Note: Jason still works at AWS, but per corporate social media policy, I changed my GitHub username to not have `aws` in it anymore
+
+
+- Vulnerability reporting
+	- We've turned on public reporting of vulnerabilities in IPython and [Jupyter Security](https://github.com/jupyter/security/security/advisories/new)
+	- Workflow is: person submits a report, an admin accepts the report and creates a "draft"
+	- Reports are per-repo. It doesn't seem like there is a way to consolidate at the org level
+	- It appears that only admin permissions can see the draft vuln reports
+	- How to track reports?
+		- We can have a single place where reports are done, so the security team can track it and open appropriate reports in subprojects
+		- We can have a per-repo or per-subproject place to report, with a reporting structure in place between projects to track vulnerabilities
+		- This process decision should be made at the SSC level in cooperation with other subprojects
+		- Even if we have per-subproject reporting, we can have a catch-all reporting place in jupyter/security
+- SSC formation
+	- SSC reps are known at this point, and needs to self-organize at this point
+	- EC meetings are on Monday. Perhaps the SSC members can be invited so we can all discuss how to launch these councils
+	- https://deploy-preview-712--jupyter-github-io.netlify.app/ - preview of website update listing the SSC in the About page
+- 

meetings/README.md

@@ -17,6 +17,7 @@ What this meeting is about:
 
 ## Meeting Minutes
 
+* [2023-01-03](2023-01-03.md)
 * [2022-12-06](2022-12-06.md)
 * [2022-10-11](2022-10-11.md)
 * [2022-09-27](2022-09-27.md)