Pub-dev: consider option to opt-out of emails

[jonasfj]

We currently send an email to all uploaders whenever a package is published.

This is largely a security feature to help detect compromises. We can't possibly stop all attacks, but if users can detect attacks and report them that is fantastic, as it enables us to find out how people were compromised and, thus, consider mitigating the attack vector.

But we could consider letting users opt-out of this... On other hand, forcing users to receive emails is a security feature.

[jonasfj]

I vote that we don't let users opt out of emails, as these emails makes it easy to detect an unauthorized package publication.

[jonasfj]

Note. other options we could consider:

• Only send these emails the "contact email" for the publisher.
• Only send these emails to the user that uploaded the package.
• Only send these emails to users who have previously uploaded the package.
• Or all of the above.

But sending to all members of a publisher is probably overkill, and will cause these emails to be filtered out which is counter productive to security.

[athomas]

We could also have different roles (currently everyone is admin) and then:

• Email all admins.
• Email the member/writer (whatever the other role would be called) that uploaded the package.