CPAN-SEC Charter & Governance

[sjn]

Hei!

I'm thinking it's prudent we agree on a minimum set of policies. Mostly, this is to communicate to others what we're about and interested in, and what's in-scope and out-of-scope for us, and how we intend to operate and behave.

So I'd like to suggest we put together a few documents:

• Minimal instructions for collective decision making and conflict resolution
  • For policy matters, a simple (50% + 1) majority vote of yes/no/pass among CPAN-Security group members
  • For other matters, a simple (50% + 1) majority vote of yes/no/pass among public CPAN-Security group core member ("group owner")
  • Until these instructions are in place, we use a simple majority vote among IRC participants
• Instructions on how to join the CPAN-Security group, and how to become a core member ("group owner")
  • For members, by invitation. This may happen in public (conferences, public fora) or privately from an existing member.
  • For core members, only by invitation from two core members who vouch for the person.
• A simple and enforceable Standards of Conduct
  • e.g. TPRC's SoC
• Instructions on How to conduct Responsible Disclosure
  • e.g. Contact the mailing list with the exploit, contact the affected author, agree on an embargo period with the author...
• A charter describing what we're about, who we cooperate with, and what's in and out-of-scope.
  • e.g. our initial proposal for our charter, already published on our website.

I guess there's more, but let's start here... What's missing? What resources can we steal^H^H^H^H^Hlearn from? 😁

[Ovid]

Since no one has commented and you have three thumbs up (disclaimer: one is mine), I'd say push this forward.

One of the biggest issues in projects like this is getting traction, so going for the "ask forgiveness instead of permission" approach can make this happen and we can revisit it later.

[sjn]

Aaaah.

It would be soooo nice to have at least some public acknowledgement from a few well-renowned actors. At least so we reduce the risk of coming across as a bunch of posers and ne'er-do-wells 😁

I get your sentiment though. With the NIS2 and CRA monsters looming, we should probably get on with the hacking. 😎

[Ovid]

Yes, we should get on with hacking! I've started a pure-Perl CycloneDX::Parser. We'll need that eventually, I think.

Currently it targets only JSON and version 1.5. It is very incomplete.