Open krassowski opened 2 years ago
It could help to clarify how to sign up for the second (more open) mailing list and what are the vetting criteria for the membership.
There is no particular vetting, not particular communication channel, it's mostly to not have automatic scraping, and make sure that we don't get random mails or people who don't understand what the mailinglist is for. We get a lot of spam on security@ipython.org, from marketing, SEO, and anything that crawl the web.
List of the ipython-security google group members that are owner:
I'm open to any changes to the communication channels, and formalisation.
Speaking of spam, would it make sense to re-start the mailing list from scratch using a different address so that the emails are not flagged as spam? I think it currently uses an
ipython
-based address and we could probably have one withjupyter
instead.
I would avoid @jupyter.org
as well, it's not better maintained than IPython.org, this was one of the reason tha made me propose security@numfocus.org in #7
A recent blog post described two mailing lists relating to security:
It could help to clarify how to sign up for the second (more open) mailing list and what are the vetting criteria for the membership. As for signing up, the number of Jupyter contributors across all the projects is not small and not everyone will be already on the list/have rights to add others (and the term Jupyter developer is not well defined for me either) so clarifying who can add new members and which communication channel to use (gitter? discourse? email?) would help a lot. I imagine that the new security page, or the README of this repo (or both) would be a good place to host this information.
The documentation should mention that once added the new members will receive a message from "Jupyter Security" confirming their subscription (and they can unsubscribe at any time), which may land in spam (but no confirmation is required). We could also note that the membership is visible to other members.
Speaking of spam, would it make sense to re-start the mailing list from scratch using a different address so that the emails are not flagged as spam? I think it currently uses an
ipython
-based address and we could probably have one withjupyter
instead.