continuity policy and package registries?

[ctcpip]

it didn't occur to me before when discussing #1327, but do we also need to address this issue wrt package registries, e.g. npm ?

cc @bensternthal

[bensternthal]

@ctcpip I 100% agree. We can tackle this next.

[mcollina]

node.js has https://www.npmjs.com/~nodejs-foundation

[tobie]

Discussed in the CPC call today. General agreement to include this in the continuity policy. @bensternthal to open a PR.

[tobie]

Notes from this week's CPC call:

• Using HospitalRun as a test case
• Issue transferring the package
• Maintainers filed issues with NPM
• Waiting on the result of having filed this issue
• Discussion in CPC suggests we should bring this to the security collab space

[0xAverageUser]

@bensternthal @ctcpip, dropping my thoughts here after today's meeting.

I think the issue spans a spectrum based on the number of maintainers per project. The policy result would be very different depending on that number.

• For projects with many maintainers (think 20+ on npm): Adding an OpenJS maintenance account creates a honeypot, increases risk with a single point of failure.
• Few or no maintainers (0-3 active): OpenJS plays a critical role in supporting, takeover, archiving, and emergency admin removal (e.g., xz-utils).

These two extremes are I think orthogonal. The policy should adapt to the number of maintainers. If this is relevant, I'm happy to contribute.

[tobie]

I like this framing quite a bit, @0xAverageUser. Could be used more broadly/elsewhere.

[tobie]

Notes from this week's CPC call:

• Was discussed in the Security collab space
• General agreement as how to move forward
• Split doc into two different pieces (one for maintainers and one for consumers)
• Now the work needs to happen
• Planning to work on it in next working session