Notes from 2023-01-23

Author: rcthomas

meetings/2023-01-17.md

@@ -0,0 +1,36 @@
+## January 17, 2023
+
+| Name               | affiliation| username         |
+| -------------------| -----------| -----------------|
+| Jason Weill        | AWS        | @JasonWeill      |
+| Matthias Bussonnier| Quansight  | @carreau         |
+| Rollin Thomas      | NERSC      | @rcthomas        |
+| Jason Grout        | Databricks | @jasongrout      |
+
+- Security email addresses
+	- [email protected] — Google Group, limited membership.
+	    - This is a limited-membership list, if someone ask to be put on it, we do a cursory check they are a real person and add them it is mostly meant for advance warning we are going to publish a release that fix a CVE and minor sec discussion.
+	    - 75 members now
+	- [email protected]
+	    - This is a forward email maintained by XXXX, that only allow up to 10 members, it is meant for security reports.
+	- Action items:
+		- Formalize policy around who gets on these lists
+		- Maybe set up new [email protected] reporting email?
+		- widen the [email protected] receivers to spread the load
+
+- Bug bounty recommendation (intigrity, etc)
+	- Jupyter as a software may not be a good fit for Intigrity. What Intigrity is offering is that if you have a service you sell with an API, we ask our researchers to pentest your service. If it's software that you install on your machine, it doesn't really fit the Intigriti model, which seems to 
+	- What services do we actually run?
+		- nbviewer - no authentication, purely displays content, so not really applicable
+		- binder
+	- A difficulty is that some people we are talking with are in the European Union, others are from Intigriti
+	- Action item:
+		- Jason G to email Intigriti, to confirm whether this is a good fit, based on previous conversations
+		- If it is a good fit, Jason G to email SSC to see what subprojects are interested, then forward that on to Intigriti
+
+- Recent reports
+	- How do we manage security reports coming in?
+	- Several options:
+		- Security reports per subproject
+		- Security reports in a centralized Project Jupyter repo
+		- Security reports in a repo per subproject