Hi, I'm Nikita

The FLOSS community/ecosystem work that I do online is currently not paid for by any company or organization, I do that solely in my free time.

My current areas of interest include Node.js ecosystem and Node.js API, general security-related problems, QmlWeb, and quantum informatics.

In the Node.js-related area, I am interested mostly in locating and addressing various issues in the Node.js ecosystem, with an accent on (but not limited to) security and stability issues.

That takes about 20-30% of what could be a full-time job currently. I did receive several bounties for security issues from e.g. GitHub, but I try to optimize for impact and not for bounties, and most of my work is voluntary. During the main phase of those npm credentials leaks / reuse stories, I was asked by several people independently how did I fund the research — the honest answer was that I didn't, and I performed that solely in my free time. There are also direct expenses in some of those cases — i.e. I am paying for hosting and processing power for some of the tasks, and for other things like coworking space access.

Over the recent time, I:

• discovered and reported some security-related issues in Node.js, npm, and ecosystem packages,
• made some public posts aimed at improving the ecosystem security (note: not all issues deserved a post — only those that I wanted to bring the public attention to, the top reason is to stop the ecosystem from doing bad things in their own code),
• probably the most significant of those was the massive credentials leak/reusage story, in several parts (one, two), which you could have heard about (I'm still spending my time on that issue even now),
• resurrected QmlWeb (originally written by other people — see the graph and started an attempt to merge its numerous forks back into one piece, that was accomplished with everyone contributing in one repo now,
• filed a significant number of issues (a large part of those were similar) to various projects with suggestions, in-advance warnings of future deprecations and semver-major changes on Node.js side, and about those some projects doing an obviously wrong thing (like packaging what they didn't want to or other obvious mistakes),
• have been trying hard to estimate the impact of some semver-major API changes on Node.js side,
• made some number of general issue an PR comments and reviews for Node.js, and have been doing some usual CTC/TSC member stuff.

Most of that is shared on GitHub (my username is @ChALkeR), but a significant part is not:

• private repos — e.g. preliminary private notes, the tooling used to perform attacks on npm (shared with npm), some other stuff shared with affected projects and parties,
• private emails / DMs — e.g. most security-related reports,
• most time that spent on code review / analysis produce no visible result — and that is a good thing, that means that I wasn't able to locate issues in those libraries.

Recently, with the appearance of Node.js third-party modules security program, I also started filing my reports for significant modules through that one, instead of simple emails to maintainers — that is more organized, visible and makes sure that it goes into various databases for e.g. automated deps detection. Some of those are fixed by now and should be disclosed fairly soon.

In future, I am planning to:

• find and report more security-related issues and perform more audits,
• spend more time taking a look at issues and pull requests,
• investigate building an automated tool that would find and help report common issues and mistakes in Node.js ecosystem libraries,
• give some more love to QmlWeb,
• write some more notes about common security issues in the ecosystem.

This fundraiser, if it succeeds, might help to to achieve the above goals faster and with more significant results.

Other things that I probably would have devoted some time to if I had more of that time is some investigation of secure and usable means of communication (ref).

I am planning to continue contributing to FLOSS even if this attempt fails, but if it succeeds — it will help me to stop doing things that I like less (and which bring some stress to my life) and start doing more things that I like more (i.e. FLOSS activity).

What would this give?

• More work on Gzemnid the ecosystem analysis toolset — it needs some crucial features.
• More time for me to spend on inspecting API usage, sending patches, doing code review and other related activity.
• I would be able to do more work on improving Node.js ecosystem security at a whole, from various directions.
• I would be able to do more work (and more organized work) on reviewing ecosystem packages security. And probably, more reports.
• From the personal point of view — this will help me concentrate on working on things that I love doing (FLOSS and community/ecosystem issues) instead of doing things that I like less, while still being able to pay my bills. That would make me a happier person.
• The burn-out that could be observed on my GitHub activity over September-December was probably caused by the ratio of effort and time that I devoted to making the ecosystem better to the feedback that I received on that from parties involved. If this fundraiser succeeds, it would provide me positive reinforcement that I need to keep going. This is one of the significant reasons why I'm finally starting a personal fundraiser.

Contacts

If you have any questions, you can contact me over Gitter or over email. Also, Twitter DMs are open.

---

Also, PayPal works for one-time donations. ;-)

Notice: this fundraiser is entirely personal, it's not directly affiliated with any projects which I participate in.