PEP 811: Defining Python Security Response Team membership and responsibilities

[sethmlarson (Seth Michael Larson)]

@steve.dower

I’d be happier with something like “New PSRT members must be proposed to SC … and are expected to be drawn from core developers, triagers, or PSF staff.” Which doesn’t rule out the possibility of adding someone else, but makes the expectation pretty clear.

Yeah, if the SC is doing filtering then we can change the requirement into a suggestion. This will also simplify the “legacied” PSRT member story, too.

@barry

a nomination process similar to core dev since reasonable. Meaning, PSRT members may nominate new members, and existing PSRT members would vote, with 2/3rds positive vote to be included, and given no PSC veto.

We could adopt a process similar to core team nominations. So then the Steering Council would only be able to remove PSRT members with their own vote? I do agree with you and @steve.dower that self-nominations to the SC isn’t appropriate.

@malemburg

@sethmlarson

I can certainly abstract this out so that PSRT is able to choose its tool based on where the projects are hosted and what is available there.

Was this an oversight ?

There were comments from @gpshead, @JacobCoffee, and @hugovk about keeping the PEP as-is and amending the PEP if we were ever to migrate off GitHub, given if we were to stop using GitHub we’d need to change many other PEPs, too. Hopefully this is okay with you?

@malemburg

The PSRT only triages a double-digit number of reports every year, meaning there aren’t an abundance of opportunities to “prove” activity on the scale of months. For this reason along with aligning with existing yearly schedules for the Steering Council, a yearly pruning was recommended.

Shouldn’t that last sentence read "For this reason along with aligning with existing yearly schedules for the Steering Council, a yearly pruning is not recommended.

The PEP recommends a yearly schedule for pruning (or rather, recommending to the Steering Council candidates to prune), so this sentence is correct. Maybe it can be more clear?