{"action":"created","issue":{"url":"https://api.github.com/repos/nodejs/security-wg/issues/31","repository_url":"https://api.github.com/repos/nodejs/security-wg","labels_url":"https://api.github.com/repos/nodejs/security-wg/issues/31/labels{/name}","comments_url":"https://api.github.com/repos/nodejs/security-wg/issues/31/comments","events_url":"https://api.github.com/repos/nodejs/security-wg/issues/31/events","html_url":"https://github.com/nodejs/security-wg/issues/31","id":245290426,"number":31,"title":"Document Security Announcement process","user":{"login":"mhdawson","id":9373002,"avatar_url":"https://avatars3.githubusercontent.com/u/9373002?v=4","gravatar_id":"","url":"https://api.github.com/users/mhdawson","html_url":"https://github.com/mhdawson","followers_url":"https://api.github.com/users/mhdawson/followers","following_url":"https://api.github.com/users/mhdawson/following{/other_user}","gists_url":"https://api.github.com/users/mhdawson/gists{/gist_id}","starred_url":"https://api.github.com/users/mhdawson/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mhdawson/subscriptions","organizations_url":"https://api.github.com/users/mhdawson/orgs","repos_url":"https://api.github.com/users/mhdawson/repos","events_url":"https://api.github.com/users/mhdawson/events{/privacy}","received_events_url":"https://api.github.com/users/mhdawson/received_events","type":"User","site_admin":false},"labels":[{"id":503869658,"url":"https://api.github.com/repos/nodejs/security-wg/labels/wg-agenda","name":"wg-agenda","color":"0052cc","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2017-07-25T05:35:44Z","updated_at":"2017-08-20T23:48:28Z","closed_at":null,"body":"First cut at documenting the security announcement process.  I think we have agreement that our processes documented publicly even in cases like the security announcement process were some of the work must be completed in private.  The security wg is probably the place to discuss these and possibly the place to document them.  Once we are in general agreement on where the doc should go I'll move the text into a PR on the appropriate repo.\r\n\r\n* On issue for security vulnerability in private security repo, propose candidate text based on past announcements.\r\n\r\n* Once reviewed, agree on timing for announcement and line up releasers to make sure they are available to do the release on that date.\r\n\r\n* Post to https://groups.google.com/forum/#!forum/nodejs-sec. Note that you will need to have\r\nbeen given access by one of the existing managers (Ben Noordhuis, Rod Vagg, Trevor\r\nNorris, Michael Dawson). You will have to manually edit to add formatting and links\r\nproperly.\r\n\r\n* Mirror post in vulnerabilities section of Nodejs.org blog section.\r\nSubmit PR and leave 1 hour for review. After one hour even if no reviews, land anyway so that we\r\ndon't have too big a gap between post to nodejs-sec and blog. Text was already reviewed in security\r\nrepo so.\r\n\r\n* In original PR for security issue, post candidate text for updates that will go out with releases that\r\nwill indicates releases are available and include full vulnerability details.\r\n\r\n* Once releases are made, post response to original message in\r\nhttps://groups.google.com/forum/#!forum/nodejs-sec indicating releases are available and with the\r\nfull vulnerability details.\r\n\r\n* Update the blog post in https://github.com/nodejs/nodejs.org/tree/master/locale/en/blog/vulnerability\r\nwith the information that releases are available and the full vulnerability details.\r\nKeep the original blog content at the bottom of the blog. This is an example:\r\nhttps://github.com/nodejs/nodejs.org/blob/master/locale/en/blog/vulnerability/june-2016-security-releases.md. Make sure to update the date in the slug so that it will move to the top of the blog list.\r\n\r\n* Tweet out a link to the nodejs-sec announcement\r\n\r\n* Email foundation contact to tweet out nodejs-sec announcement from foundation twitter account ?"},"comment":{"url":"https://api.github.com/repos/nodejs/security-wg/issues/comments/323619787","html_url":"https://github.com/nodejs/security-wg/issues/31#issuecomment-323619787","issue_url":"https://api.github.com/repos/nodejs/security-wg/issues/31","id":323619787,"user":{"login":"rvagg","id":495647,"avatar_url":"https://avatars2.githubusercontent.com/u/495647?v=4","gravatar_id":"","url":"https://api.github.com/users/rvagg","html_url":"https://github.com/rvagg","followers_url":"https://api.github.com/users/rvagg/followers","following_url":"https://api.github.com/users/rvagg/following{/other_user}","gists_url":"https://api.github.com/users/rvagg/gists{/gist_id}","starred_url":"https://api.github.com/users/rvagg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rvagg/subscriptions","organizations_url":"https://api.github.com/users/rvagg/orgs","repos_url":"https://api.github.com/users/rvagg/repos","events_url":"https://api.github.com/users/rvagg/events{/privacy}","received_events_url":"https://api.github.com/users/rvagg/received_events","type":"User","site_admin":false},"created_at":"2017-08-20T23:48:28Z","updated_at":"2017-08-20T23:48:28Z","body":"@gibfahn ftr I've never maintained a strict time on posting these, most of them have been published immediately. _However_ that Website WG is good at picking up spelling, grammar and other text problems, they've done so for a number of my posts, so it's good to have them involved. All of that stuff can be edited afterward too so NBD either way."}}
{"actor":{"display_login":"rvagg"}}