Move to LFX

[avivkeller]

This proposal moves our @iojs.org mailing aliases into the Linux Foundation's LFX Project Control Center under the @nodejs.org alias, which gives us managed committees and mailing lists with support for surveys and voting.

(For purposes of this document, → should be interpreted as email@domain.tld forwards to email@domain.tld)

Each alias falls into one of four categories:

1. Converted to a Working Group: These will be upgraded to LFX and are fine to continue using. They will¹ be automatically updated as our GitHub Teams evolve
2. Supported: These aliases that remain in active use, and for the most part redirect to an alias defined in (1). These will be upgraded to LFX and are fine to continue using.
3. Maintenance: These aliases are kept only for legacy or operational reasons. These will be upgraded to LFX, but only so existing integrations keep working; new usage is discouraged, and users should move to an alias defined in (1).
4. Deprecated: aliases that will not be upgraded to LFX. They remain reachable only through their @iojs.org counterpart, which will eventually stop working.

Two general principles apply throughout:

• LF-controlled aliases will be replaced by this proposal.
• *@iojs.org aliases will not be touched for now, but should be gradually phased out after the migration to @nodejs.org on LFX is complete.
• *@iojs.org aliases will redirect to *@nodejs.org once this migration is complete.

---

1. Converted to a Working Group

I've created the following committees in LFX, with this proposed mapping.
These will be upgraded to LFX and are fine to continue using.

• Technical Steering Committee: tsc@nodejs.org
• Moderation Team: moderation@nodejs.org
• Discord Moderation Team: moderation-discord@nodejs.org
• Build Working Group: build@nodejs.org
• Website & Infrastructure Working Group: web@nodejs.org
• Jenkins Administrators: ci@nodejs.org
• Security Triage Team: security-triage@nodejs.org
• Release Working Group: release@nodejs.org
• Undici Maintainers: undici@nodejs.org

---

2. Supported

These externally-facing aliases remain in active use. They will be upgraded
to LFX and forward to the relevant working-group alias (with an exception of security@); they are fine to
continue using.

• report@nodejs.org forwards to moderation@nodejs.org
• report-discord@nodejs.org → moderation-discord@nodejs.org
• security@nodejs.org → nodejs-79566c66a30b0312@forwarding.hackerone.com

---

3. Maintenance

These aliases will be upgraded to LFX, but only for legacy reasons. They will keep working for the time being so existing integrations don't break, but new usage is discouraged.

Note: They are not mapped 1:1 with their previous mappings.

• admin@nodejs.org forwards to build-infra@nodejs.org
• accounts@nodejs.org → build-infra@nodejs.org
• nodejs-pypi@nodejs.org → build-infra@nodejs.org
• nodejs-vercel@nodejs.org → web@nodejs.org
• nodejs-crowdin@nodejs.org → web@nodejs.org
• cve-request@nodejs.org → security-triage@nodejs.org
• cve-mitre-contact@nodejs.org → security-triage@nodejs.org
• cna-discussion-list@nodejs.org → security-triage@nodejs.org
• ci-alert@nodejs.org → ci@nodejs.org
• release-validation-alert@nodejs.org → build-infra@nodejs.org.
• zoom-nodejs@nodejs.org → tsc@nodejs.org²
• wiby-bot@nodejs.org → bjohansebas@gmail.com + hello+wibybot@dominykas.com
• github-bot@nodejs.org → tsc@nodejs.org

---

4. Deprecated

These aliases will not be upgraded to LFX. They remain reachable only via
their @iojs.org counterpart, which will eventually stop working. If any are
still in use, please let me know.

• rvagg@iojs.org
  Personal account; no longer needed as a project alias.
• nodejs-lfx-bounty@iojs.org
  No longer needed.
• security-ecosystem@iojs.org
  The associated HackerOne account has been closed, as far as I'm aware.

Footnotes

1. In the future ↩

2. We are in the process of moving away from Zoom meetings created using this email, and as such, this email will forward to TSC for legacy reasons, but will be deprecated in the near future. ↩

[richardlau]

I think this might need to be done on a case by case basis. Possibly mailing only lists could be migrated but functional aliases such as build's is used in several of the infra providers.

[avivkeller]

Yes, the 3-4 functional aliases that we have cannot be moved, since these are full service accounts and not simple mailing lists.

I think we should start by migrating the web team aliases, since I can monitor how well they are working.

[avivkeller]

(For purposes of this document, → should be interpreted as email@domain.tld forwards to email@domain.tld)

Each alias falls into one of four categories:

1. Converted to a Working Group: These will be upgraded to LFX and are fine to continue using. They will¹ be automatically updated as our GitHub Teams evolve
2. Supported: These aliases that remain in active use, and for the most part redirect to an alias defined in (1). These will be upgraded to LFX and are fine to continue using.
3. Maintenance: These aliases are kept only for legacy or operational reasons. These will be upgraded to LFX, but only so existing integrations keep working; new usage is discouraged, and users should move to an alias defined in (1).
4. Deprecated: aliases that will not be upgraded to LFX. They remain reachable only through their @iojs.org counterpart, which will eventually stop working.

Two general principles apply throughout:

• LF-controlled aliases will be replaced by this proposal.
• *@iojs.org aliases will not be touched for now, but should be gradually phased out after the migration to @nodejs.org on LFX is complete.

---

1. Converted to a Working Group

I've created the following committees in LFX, with this proposed mapping.
These will be upgraded to LFX and are fine to continue using.

• Technical Steering Committee: tsc@nodejs.org
• Moderation Team: moderation@nodejs.org
• Discord Moderation Team: moderation-discord@nodejs.org
• Build Working Group: build@nodejs.org
• Website & Infrastructure Working Group: web@nodejs.org
• Jenkins Administrators: ci@nodejs.org
• Security Triage Team: security-triage@nodejs.org
• Release Working Group: release@nodejs.org
• Undici Maintainers: undici@nodejs.org

---

2. Supported

These externally-facing aliases remain in active use. They will be upgraded
to LFX and forward to the relevant working-group alias (with an exception of security@); they are fine to
continue using.

• report@nodejs.org forwards to moderation@nodejs.org
• report-discord@nodejs.org → moderation-discord@nodejs.org
• security@nodejs.org → nodejs-79566c66a30b0312@forwarding.hackerone.com

---

3. Maintenance

These aliases will be upgraded to LFX, but only for legacy reasons. They will keep working for the time being so existing integrations don't break, but new usage is discouraged.

Note: They are not mapped 1:1 with their previous mappings.

• admin@nodejs.org forwards to build-infra@nodejs.org
• accounts@nodejs.org → build-infra@nodejs.org
• nodejs-pypi@nodejs.org → build-infra@nodejs.org
• nodejs-vercel@nodejs.org → web@nodejs.org
• nodejs-crowdin@nodejs.org → web@nodejs.org
• cve-request@nodejs.org → security-triage@nodejs.org
• cve-mitre-contact@nodejs.org → security-triage@nodejs.org
• cna-discussion-list@nodejs.org → security-triage@nodejs.org
• ci-alert@nodejs.org → ci@nodejs.org
• release-validation-alert@nodejs.org → release@nodejs.org.
• zoom-nodejs@nodejs.org → tsc@nodejs.org
• wiby-bot@nodejs.org → bjohansebas@gmail.com + hello+wibybot@dominykas.com
• github-bot@nodejs.org → tsc@nodejs.org

---

4. Deprecated

These aliases will not be upgraded to LFX. They remain reachable only via
their @iojs.org counterpart, which will eventually stop working. If any are
still in use, please let me know.

• rvagg@iojs.org
  Personal account; no longer needed as a project alias.
• nodejs-lfx-bounty@iojs.org
  No longer needed.
• security-ecosystem@iojs.org
  The associated HackerOne account has been closed, as far as I'm aware.

Footnotes

1. In the future ↩

[richardlau]

I've created the following committees in LFX, and here's my proposed mapping:

* [Technical Steering Committee](https://projectadmin.lfx.linuxfoundation.org/project/a092M00001IV4HSQA1/collaboration/committees/d4186f20-9af3-4bc2-8f5d-da44eeff54a9): `tsc@nodejs.org`

This alias exists today, so how is this going to work? Does the proposal replace the existing LF managed account? (I'm not even sure how the LF account is currently set up as it isn't managed by the Build WG -- @RafaelGSS mentioned that he didn't get emails sent to the existing nodejs.org alias).

The following aliases are simple 1:1 aliases without a committee, and can probably be set up with LFX email forwarding. After this migration, we should consider these aliases deprecated, in favor of the ones above. After all services linked to the deprecated aliases are updated, these can be removed entirely2:

First of all the existing aliases (the left hand side of the mapping) are *@iojs.org (with the exception of tsc where there is the Build WG alias at iojs.org and the LF managed one at nodejs.org).

* `zoom-nodejs@nodejs.org`: `tsc@nodejs.org`[1](#user-content-fn-4-c66be792d8d2ef35990e4a6d06fa59c2)

This is wrong. I believe this alias is for the people who host meetings on Zoom and

• those are not all TSC.
• neither are all TSC on this alias.

There might be a valid question of whether the alias is needed if all WG meetings are moved to LFX, but the point is that it is not the same list as the TSC.

* `ci-alert@nodejs.org`: `ci@nodejs.org`[1](#user-content-fn-4-c66be792d8d2ef35990e4a6d06fa59c2)

I'd keep the -alert to make it clear what this list is for.

* `cve-request@nodejs.org`: `security-wg@nodejs.org`

* `cve-mitre-contact@nodejs.org`: `security-wg@nodejs.org`

* `cna-discussion-list@nodejs.org`: `security-wg@nodejs.org`

This is wrong. Security reports should be going to the security team, which is not the same as the Security WG.

* `release-validation-alert@nodejs.org`: `release@nodejs.org`[1](#user-content-fn-4-c66be792d8d2ef35990e4a6d06fa59c2)

Same as for ci-alert above, this obfuscates the purpose for this list.

[avivkeller]

Thanks! I’ll iterate in a HackMD document to make review easier.
To answer your first question, the idea is:
1. Any LF-controlled aliases will be replaced by the proposal.
2. @iojs.org aliases will not be touched for now, but they should gradually be removed after the migration to @nodejs.org.
When I say certain aliases should be “deprecated,” I mean they should be upgraded to @nodejs.org. Since they are direct 1:1 mappings to other aliases, they should no longer be used going forward.

[richardlau]

I think my confusion is that I don't understand the second mapping. That isn't a 1:1 mapping and instead appears to be attempting to collapse them into the aliases for the working groups, which is not how we're handling the mailing aliases.

[avivkeller]

Okay, there's a big misunderstanding around how this would work, which I'm sorry for. 1:1 was supposed to mean that one alias = one destination, not that these aliases would be replaced.

[avivkeller]

I've updated the proposal above

[avivkeller]

@nodejs/TSC PTAL at the original issue for my proposal

[abduljaleelvpjallu-arch]

[mcollina]

Given the hiccups we had with the meetings, I think we should hold off for this for a while and reassess.

This system worked extremely well for a decade, I'm not sure it's worth changing.