doc: clarify triage comitments

[mhdawson]

No description provided.

[nodejs-github-bot]

Review requested:

• @nodejs/node-api

[Trott]

"are away on holiday" is...basically..."whenever we say we're not available'....This makes the whole response-time guarantee far less meaningful.

Looking at Python's security document, Chromium's, Ruby's... none of them seem to supply a specific response-time guarantee. I think we should just remove the guarantee entirely or replace it with a vague "will respond promptly" or "will respond in a reasonable time frame".

[mcollina]

SGTM to remove the time commitments altogether.

[gireeshpunathil]

my view: the new commitment text reflects the real posible reasons behind a potential delay in response, aligning to what an open source project could commit at the best.

[Trott]

@nodejs/security-triage

[mhdawson]

I personally prefer setting some kind of expectation so that people know that it won't be immediate and with the addition it's clear that there will also be times when we can't meet the 5/10 days.

[Trott]

I personally prefer setting some kind of expectation so that people know that it won't be immediate and with the addition it's clear that there will also be times when we can't meet the 5/10 days.

I think a better approach is an auto-reply to submitted reports with that information. "Thank you for submitting your report. We aim to reply with an initial assessment within 5 days excluding weekends and holidays." That gets the information to the specific person that needs it at the specific time when they need it. That's better, IMO, then adding it to a document they are likely to not read or even know about at all.

[Trott]

I personally prefer setting some kind of expectation so that people know that it won't be immediate and with the addition it's clear that there will also be times when we can't meet the 5/10 days.

I think a better approach is an auto-reply to submitted reports with that information. "Thank you for submitting your report. We aim to reply with an initial assessment within 5 days excluding weekends and holidays." That gets the information to the specific person that needs it at the specific time when they need it. That's better, IMO, then adding it to a document they are likely to not read or even know about at all.

(Although to be clear: I'm not blocking this. This is entirely up to the security triage team as far as I'm concerned, and you are on the security triage team and I am not. So, it's your call.)

[mhdawson]

So I agree an auto respond makes sense in addition to this landing. Don't know though if we have any autoresponders but would be happy if somebody wanted to set one up for this. I do see that as a separate effort though and so it should not block the PR itself.

[mhdawson]

@nodejs/security-triage it would be good to hear from more members

[mhdawson]

@mcollina you ok with this landing?

[mcollina]

lgtm

[Trott]

Landed in da44fd8

[Trott]

When I landed this, I forgot to also update https://hackerone.com/nodejs/policy but now I've done that too.