Create a security team

[rvagg]

We need a small group of people who receive emails to security@ addresses (currently just security@iojs.org because that's all I have control over, but eventually security@nodejs.org too).

My preference would be for it not to be the entire TSC but a smaller subgroup that can quickly and discretely and escalate issues in the appropriate way. But how we construct this is open for discussion of course.

I'd like to put my hand up for serving in this role along with a couple of others.

Discuss.

[rvagg]

Also:

This is currently being controlled here: https://github.com/nodejs/email/blob/master/iojs.org/aliases.json

We'd need a ## Security section on the README to list this and explain the steps to take if you find a vulnerability.

[bnoordhuis]

I volunteer. Do I need to file a PR for that aliases file?

Also, /cc @nodejs/crypto - I believe @indutny is or was on security@nodejs.org and @shigeki probably makes a good addition as well.

[rvagg]

let's see how it shakes out in discussion, the TSC probably needs to sign off on the final list, we'll give it another week

[indutny]

Add me up.

[indutny]

Btw, it is probably a good manner to cc people when issue is created. Not everyone is watching the repo.

[rvagg]

/cc @nodejs/tsc

[Fishrock123]

Original issue: nodejs/node#430

[jasnell]

+1... Sign me up!

[cjihrig]

I would like to be on the list.

[shigeki]

Please add me to the list.

[mhdawson]

I'd like to be on the list as we need to quickly address issues in the IBM internal builds as well

[rvagg]

Proposing a security@ team:

• @rvagg
• @bnoordhuis
• @indutny
• @jasnell
• @cjihrig
• @shigeki
• @mhdawson

[misterdjules]

Joining the discussion a bit late, sorry about that. There is already a security@nodejs.org mailing list, and a process outlined at https://nodejs.org/about/security/ that a lot of people have been using to report security issues. Why not start from here?

@rvagg If you're interested in having control over the management of the security@nodejs.org mailing list, just say the word.