Initiative for CII-Best-Practices for Nodejs Projects

[UlisesGascon]

As commented in #884 seems like there is an interest to explore this idea.

Context

I discovered that we already completed the process for Nodejs, last update at 2016-05-19.

I believe we can review the current status and check if we need to update some of the answers. Also it might be quite interesting to see if we can achieve Silver or Gold level.

More information in OpenSSF Best Practices Badge Program

Next steps

• @UlisesGascon will create separe PRs to include the current Questions/answers for each level so we can brainstorm changes easily and then ask to update the project in the registry
  • CII-Best-Practices for Nodejs: Entry level #954
  • CII-Best-Practices for Nodejs: Silver level #955
  • CII-Best-Practices for Nodejs: Gold level #956
• Update the OpenSSF Best practices once the discussion is completed and the feedback is consolidated
  • Update CII-Best-Practices for Nodejs: Entry level #1305
  • Update CII-Best-Practices for Nodejs: Silver level #1306

[UlisesGascon]

@rvagg can you add me to the https://bestpractices.coreinfrastructure.org/en/projects/29? We will need to make some changes soon in order to merge #954

[rvagg]

Sorry @UlisesGascon, this one fell off my notification list in my general cull of incoming notifications, only an email from @mhdawson pointed me to it.

Entry created on 2015-11-02

This is a lifetime ago, so it's something expunged from my memory, I clicked through to the page wondering why I was being pinged about it .. but my name's on it! Project #29 in CII Best Practices, I remember now when that thing started and thinking it was a good idea .. early adopters!

I actually can't find any place where I can "add" or even transfer the thing, it looks like it's just me. I guess we could email and ask them to transfer it to someone else? Or if you want to list items that you want to edit in this thread I could go and do them. Lots of stuff to fill out for Silver and Gold but if you want to tell me which ones to tick I could go and do that.

[UlisesGascon]

Thanks @rvagg for the update, seems like we are early adopters 😃

I actually can't find any place where I can "add" or even transfer the thing, it looks like it's just me. I guess we could email and ask them to transfer it to someone else? Or if you want to list items that you want to edit in this thread I could go and do them. Lots of stuff to fill out for Silver and Gold but if you want to tell me which ones to tick I could go and do that.

I was not able to find it as well, so I guest this feature is not yet implement. Can you help us to update the records for the entry level form? In the PR #954 we discussed about what should be included. By comparing the first and the last commit https://github.com/nodejs/security-wg/compare/84945b0..1eeb152 it will be easier to visualize what has change from the current responses.

If you prefer me to do it, you can share your credentials with us (if you are using user/pass login) in the private repository 👍

We are working now in the Silver questionary in #955

[rvagg]

if you are using user/pass login

GitHub login unfortunately!

Next problem is that their form doesn't work! I can edit "passing" and "gold" but not "silver", when I go to the edit link (https://bestpractices.coreinfrastructure.org/en/projects/29/edit?criteria_level=1) it redirects back to https://bestpractices.coreinfrastructure.org/en.

I'll email them and also see if I can convert the login to user/pass or add people to it, or something.