OpenJS World

OpenJS Foundation announces first Collaboration Space: Package Vulnerability Management & Reporting

Last year, the OpenJS Foundation announced a new initiative to better align multiple communities on common issues and concerns. Collaboration Spaces are meant to help community-led efforts reach broader audiences and coordinate stakeholders from across the JavaScript ecosystem. We are excited to formally announce our very first Collab Space, Package Vulnerability Management & Reporting, championed by Wes Todd, Senior Software Engineer at Netflix and Darcy Clarke, Engineering Manager of the npm CLI team at GitHub.

When it comes to vulnerability reporting, maintainers must manage many issues – from updating dependencies to broader communications when a new CVE is reported on a popular library in our ecosystem. Many of these are being considered “false positives” from an impact/vulnerability perspective. This level of noise creates distrust in the relationships among security companies/researchers, maintainers, & the collective end-users/consumers.

The Package Vulnerability Management & Reporting Collab Space will create a neutral forum for ecosystem stakeholders to discuss and collaborate with the intention to improve CVE reporting and resolution workflows while minimizing the burden on maintainers quieting noise for consumers. This cross-functional effort has a wide reach and impacts Security Research/Organizations, Package Maintainers, and End-users/Consumers.

The goals of the Package Vulnerability Management & Reporting Collab Space include:

• Improve delineation of domains & controls
• Improve communication between maintainers & security researchers/organizations
• Improve tooling for package auditing, resolution & management as a whole Impact & users of the project

Current Collab Space members include:

• Darcy Clarke (@darcyclarke) – Champion
• Wesley Todd (@wesleytodd) – Champion
• Zbyszek Tenerowicz (@naugtur)
• Christopher Hiller (@boneskull))
• Michael Dawson (@mhdawson)
• Dominykas Blyžė (@dominykas)
• Jordan Harband (@ljharb)
• Marcin Hoppe (@MarcinHoppe)

The founding participants of this Collab Space see far-reaching benefits for the entire JavaScript ecosystem. This is of particular importance to the JS community due to the deeply interconnected relationships created with package dependency trees. Additionally, this work can, and does, extend beyond the scope of the JavaScript ecosystem itself. 

If you are interested in participating in the Package Vulnerability Management & Reporting

Collaboration Space, check out their repo on GitHib. 

Learn more about this new Collaboration Space during OpenJS World where Darcy Clarke, Github and Wes Todd, Netflix, will give the following talk, “Package Vulnerability Management and Reporting Collaboration Space for OpenJS World”

Join the speaker for live Q&A on Slack, channel – #openjs_world-security

• Wednesday, June 2 from 14:20 – 14:40 PDT /  23:20 – 23:40 CEST
• Thursday, June 3 from 11:00 – 11:20 PDT /  20:00 – 20:20 CEST

Day 2 to include IBM Workshop and Speaker Q and A

The OpenJS Foundation is gearing up for its second annual OpenJS World, a free, virtual event that gathers developers, software architects and engineers from all around the world as well as maintainers and community members from OpenJS Foundation hosted projects such as AMP, Fastify, Electron, and Node.js. 

With so many interesting talks with subject matter experts from the field, as well as the IBM Day of Workshops, we have added a second day to OpenJS World. On day one, June 2, keynotes will premier at 9 am PDT, followed by the speaker tracks. Attendees can watch our on-demand sessions in any order they wish, and then on June 2 and 3, join the speakers for live Q&A sessions on Slack. Read on for the full schedule layout across June 2 and 3.

IBM Day of Workshops
On June 3 from 7 am PDT to 12 pm PDT, IBM will be hosting a day of workshops. This is a great opportunity to learn from experts who work on the Node.js platform and who build robust Node.js applications in the field.  Those interested in attending the IBM workshops can register here, as part of the OpenJS World registration. If you’ve already registered for OpenJS World, you can add the workshop by modifying your registration.

Check out more information, and the full list of prerequisites here: https://openjsf.org/blog/2021/05/25/openjs-world-ibm-day-of-workshops-on-june-3/

OpenJS World Happy Hour
Join us on June 2, from 12:30-1:30 PDT for an OpenJS World Happy Hour. While we may be hosting this event virtually, we still want to connect with the community, live, and celebrate our collective wins. Details for joining will be posted in Slack. 

Live Speaker Q and A: June 2 and 3
We are so excited to offer OpenJS World attendees the chance to chat with speakers via Slack. We encourage you to watch the speaker sessions, and then join the speakers on Slack to ask questions and discuss their talks in dedicated Q&A sessions on June 2 and 3, 2021. We have more than 80 speaker Q and A’s across global time zones scheduled and we hope you’ll join us! 

The full speaker Q and A schedule can be found below or here: https://openjsf.org/openjs-world-2021/speaker-q-and-a/. To participate, please sign up for our Slack Channel here: https://slack.openjsf.org/

IBM, a Platinum member of the OpenJS Foundation, will be hosting a day of workshops on June 3, the day after OpenJS World keynotes and sessions go live. This is a great opportunity to learn from experts who work on the Node.js platform and who build robust Node.js applications in the field. 

Beyond the amazing talks and keynotes at the OpenJS World event and the IBM workshops and resources as well, you can always find lots of useful information at: IBM Developer.

The workshop will run from 7 am PDT to 12 pm PDT and will include a variety of talks from the Node.js and JavaScript community. 

Those interested in attending the IBM workshops can register here, as part of the OpenJS World registration. If you’ve already registered for OpenJS World, you can add the workshop by modifying your registration. 

Schedule and Prerequisites
The IBM Day of Workshops will feature some incredible hands-on opportunities for the community. Below is the schedule with the list of prerequisites so attendees can get the most out of these workshops. 

• 7 am PDT: Welcome to IBM’s day of Node.js workshops with Joe Sepi.
  
• 7 am PDT: Building a Cloud Native Node.js application (Prerequisites: Node.js 14, Docker and Kubernetes, Helm v3)
  
• 8 am PDT: Deploy to Code Engine (Prerequisites: Sign up for a free IBM Cloud account to get the most out of this workshop)
  
• 8:30 am PDT: Bespoke deploy options (Prerequisites: Sign up for a free IBM Cloud account to get the most out of this workshop)
  
• 9 am PDT: Photobooth! Building cloud-native AI-infused web apps with Node-RED (Prerequisites: The workshop material will be available to download at the start of the session. In the meantime, you’ll need: A laptop/computer with a WebCam attached that can be accessed from your browser, Node.js 12.x or 14.x, Git, Docker – this is required for the optional final step of containerizing the application you create.)
  
• 10 am PDT: Lunch with the experts: Core collaborators and application architects
  
• 11 am PDT: From zero to hero: rapid APIs with Loopback (Prerequisites: Node.js)

Register today for the OpenJS World IBM Day of Workshops!

An interview with Ionut Alixandroae, Senior Software Engineer at Esri, on the OpenJS Foundation Node.js Certification experience.

Linkedin: https://www.linkedin.com/in/ialixandroae
Twitter: https://twitter.com/ialixandroae

The OpenJS Node.js Application Developer certification (JSNAD) is a program designed to certify Node.js developers who have two or more years of experience working with Node.js. This program helps establish developers credibility in an extremely competitive job market. Having a certification helps set you apart from other candidates as it consists of exams covering applications and service deployment. 

Certification is online and proctored, simulating on-the-job scenarios. There are two versions, one for services development and one for application development. It is a two hour test that requires the implementation of multiple solutions within a Remote Desktop Linux environment. For more information on how you can get certified, test your abilities and strengthen your resume, click here.

We wanted to better understand how the Node.js Certification experience is helping developers stand out, so we spoke with Ionut Alixandroae. Ionut is a senior full-stack engineer from Munich, Germany working at Esri who took this course and recently got certified.

Ionut is currently working on his vision to create a personal technology blog, where he plans on sharing knowledge in the form of tutorials that cover various topics on Node.js.

Why did you want to be certified?
I am a full-stack developer with a background and proficiency across several programming languages. I have been using Node.js in the last 4-5 years in different projects and products, and the main reason for getting certified was a personal decision and aspiration: I wanted to prove and validate my Node.js dexterities through a certified authority such as OpenJS Foundation and The Linux Foundation. 

The second reason for buying the bundle and passing the certification was to consolidate and enhance my existing knowledge. 

What was the JSNAD testing experience like?
The certification exam is challenging and, indeed, the level is, at least, intermediate. It doesn’t challenge your ability to guess a correct answer from a list, but it challenges you to provide solutions to real problems using the Node API. This differentiates it from other exams and adds more value to it. The time is short if unused properly and some challenges felt a bit ambiguous in description and scope. I am extremely happy I passed the certification in one go, and overall, I strongly recommend it! 

How has completing the JSNAD certification impacted your work?
It added more assurance to my NodeJS software engineering abilities, and perhaps, transformed me into a more productive and robust engineer. 

What are your next steps?
I’m currently thinking about creating a personal tech blog, where I would like to share the knowledge and skills with other learners by providing practical tutorials and a broad spectrum of lessons covering different aspects of Node.js development and usage. 

Thank you, Ionut! Good luck with work and your new challenges. We’re looking forward to seeing your personal technology blog up and running!

The certification exam comes with the option of a free retake exam and for a limited time, a free testing environment preview to prepare for the upcoming exam. If you have any questions regarding the test, please click here.

We are also excited to offer all registrants of OpenJS World a special discount on Node.js Certifications and Trainings. Learn more here: https://openjsf.org/blog/2021/05/13/special-offer-get-50-node-js-certification-and-training-when-you-register-for-openjs-world/