Can we have "unsecure" features in Node.js? about security-wg HOT 5 CLOSED

I'll be interested in listing to the discussion in the meeting since I can't make it. My first thought is that it will be a challenge to community/explain/justify why we exclude some parts of our APIs from vulnerability reports. We had discussion around doing so for experimental features and the consensus was that it was not the way to go at that point in time.

from security-wg.

I don't think it's a good idea to provide insecure features in core.

We will receive issue, and h1 reports even if we mark it as insecure, because users will rely on the feature and build products and libraries on top.

I think the expectation is that if something is stable, is secure for production.
A insecure feature would be something forever experimental.
I believe that would be more useful as a separate npm package.

from security-wg.

I agree with Marco. Seems like experimental is the way to go

from security-wg.

@aduh95 During today's security team meeting, we discussed the topic of adding an explicitly insecure feature to Node.js. Our consensus, for now, is that it is not a good choice. While having it built-in may seem convenient, it is not a strong enough argument to justify it being part of the core.

If you would like to discuss this further, we welcome you to join one of our meetings.

from security-wg.

This issue has been inactive for 90 days. It will be closed in 14 days unless there is further activity or the stale label is taken off.

from security-wg.