Requirement (Gold level): Use basic good cryptographic practices
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 548
- Forks
- 133
- Avg merge
- 1d 22h
- Merged PRs (30d)
- 2
Description
We agreed on #1175 to open an issue to follow up a discussion about this requirement for Node.js (cc: @mhdawson @ljharb @RafaelGSS)
The software produced by the project MUST support secure protocols for all of its network communications, such as SSHv2 or later, TLS1.2 or later (HTTPS), IPsec, SFTP, and SNMPv3. Insecure protocols such as FTP, HTTP, telnet, SSLv3 or earlier, and SSHv1 MUST be disabled by default, and only enabled if the user specifically configures it. If the software produced by the project does not support network communications, select "not applicable" (N/A).
Context
- Discussion during the last meeting (Minute 42:46)
- CII Best Practices: Security
- Team Discussion
- See related question in Silver Criteria
Potential actions
TBD
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Read issue #1175, the linked security-wg discussion and PR #956, and tools/ossf_best_practices/silver_criteria.md first. Resolve the TBD potential actions for the quoted protocol requirement; done means the team has recorded a decision and a concrete follow-up.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- node.js
- Domain
- networking, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100