Hi, in my understanding this is a two-step process: First https://wikitech.wikimedia.org/wiki/Volunteer_NDA (CC'ing @KFrancis), and afterwards a separate request following https://www.mediawiki.org/wiki/Security/SOP/Access_to_Phabricator_Security_Issues

Oops, sorry! We're indeed requesting the NDA specifically in this task. Focused so much on the reason that I didn't clarify it outside of the title...

We'd like to be notified on any security issues relevant to third-party sites.

It doesn't work like that; no pro-active notification is done.

Access to security issues works just as fine, we can monitor for anything that impacts wiki.gg. Sorry for the confusion on my end.

Hi, what are the next steps here? Do we need to file something other than this ticket? (Again the aim of this ticket is to request the NDA)

In T365070#9839752, @RheingoldRiver wrote:

Hi, what are the next steps here? Do we need to file something other than this ticket? (Again the aim of this ticket is to request the NDA)

@KFrancis, would you be able to help @Alex44019, @RheingoldRiver, and @ReedemtheD3ad get Volunteer NDAs?

Hello, please have @Alex44019, @RheingoldRiver, and @ReedemtheD3ad send me their Name, mailing address, and email to kfrancis@wikimedia.org and I'll put the agreements together. Thanks!

River has sent an e-mail 15 minutes ago including all the information. Thank you

Thanks so much! I'll process the agreements and send them out for signatures soon.

All three of us have signed :)

Hello all, I am confirming the three NDA's have been signed. Please proceed with next steps. Thanks!

Access to security issues works just as fine, we can monitor for anything that impacts wiki.gg. Sorry for the confusion on my end.

So volunteer security bug access is unfortunately a very difficult issue. We only have a handful of folks who have been given this access and they are typically former or current WMF staff and/or are extremely active in triaging and working on security issues within the Wikimedia ecosystem. We've tried offering more limited security bug access in the past to various MediaWiki operators (e.g. T101017) but that wasn't possible since it's all-or-nothing access to every security bug within Phabricator, including some extremely sensitive issues regarding current and past security incidents. I'm not going to say that this isn't possible, but it would require WMF-Legal and various leadership at the WMF understanding and accepting this risk.

Understood, we didn't realize it was such a restricted group of people. We would be happy to have just one person approved, either Alex (preferred) or myself, if this helps.

@colewhite: Which task author of third-party or subtask is this task stalled on exactly?

In T365070#9871749, @Aklapper wrote:

@colewhite: Which task author of third-party or subtask is this task stalled on exactly?

This task is waiting for approval from a c-level exec, the security team, my manager (or any wmf manager), and a wmf sponsor per the Volunteer NDA and WIKISEC-PHABSECACCESS-SOP. I sent them an email requesting a reply on this task back on May 31st.