What does TEAM email do? Does it grant all members ownership of the code? If so, you should avoid security-dev as it's a public list.

https://docs.google.com/document/d/1jty6UsFMW9-SYgpQC-ztEc3lltziOQBBArMkROCSTh0/edit#

In particular: no, it does not grant ownership.

* does it have to be a chromium email?

* does security-enamel@chromium already exist?

> * does it have to be a chromium email?

No idea (the doc doesn't explicitly say so), but all the examples are. [1]

> * does security-enamel@chromium already exist?

Yes, that's what we use for Enamel security reviews.

[1] https://cs.chromium.org/search/?q=file:OWNERS+TEAM&type=cs

ok, seems reasonable to use security-enamel then

I'm still a bit uncertain.

sshruthi@, could you give us some advice?
The Enamel (Security UX) team [1] is one of three teams under the Chrome Security [2].
We have two chromium.org mailing lists:

- security-dev@: General security team. Public mailing list
- security-enamel@: Contains a *subset* of Enamel team, because it is currently used only for certain security reviews (we don't expect all team members to be on it at the moment). Private mailing list.

security-enamel@ is more accurate, but it might prevent both team members and external people from getting any emails related to the code that they should be able to see.

[1] https://www.chromium.org/Home/chromium-security/enamel
[2] https://www.chromium.org/Home/chromium-security/

> security-enamel@ is more accurate, but it might prevent both team members and external people from getting any emails related to the code that they should be able to see.

(And I think we should strongly fight against anything that leads to decisions and explanations in unintentionally unreachable places.)

Thanks for reaching out, lgarron@
The mailing list should be a public one (the doc mentions this in a couple places, but perhaps not very visibly), since as you rightly point out, folks won't be able to reach it otherwise. Does security-enamel@ have to be a private mailing list? It does sound like the right list, if it can be opened up and expanded. But, I obviously don't have enough context to know if that is a possibility.

@lucas, is this something you can add?

I can, if security-dev@ is okay.

i think security-dev is fine

https://chromium-review.googlesource.com/#/c/592161/

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/62eca6ddfdd72d93152b48ee434afda1d6550e12

commit 62eca6ddfdd72d93152b48ee434afda1d6550e12
Author: Lucas Garron <lgarron@chromium.org>
Date: Mon Jul 31 13:46:27 2017

Add team to page_info OWNERS files.

Bug:  701452 
Change-Id: I678802b5c69729b6c9422b8fffd1c3df7354760c
Reviewed-on: https://chromium-review.googlesource.com/592161
Reviewed-by: Raymes Khoury <raymes@chromium.org>
Reviewed-by: Robert Sesek <rsesek@chromium.org>
Commit-Queue: Lucas Garron <lgarron@chromium.org>
Cr-Commit-Position: refs/heads/master@{#490754}
[modify] https://crrev.com/62eca6ddfdd72d93152b48ee434afda1d6550e12/chrome/browser/ui/cocoa/page_info/OWNERS
[modify] https://crrev.com/62eca6ddfdd72d93152b48ee434afda1d6550e12/chrome/browser/ui/page_info/OWNERS
[modify] https://crrev.com/62eca6ddfdd72d93152b48ee434afda1d6550e12/chrome/browser/ui/views/page_info/OWNERS