4 ms·

> The matrix.org homeserver has been rebuilt and is running securely; We should have more bounties. Let users donate and put wallets on servers. Attacker will

by comboy 8y ago

> The matrix.org homeserver has been rebuilt and is running securely; We should have more bounties. Let users donate and put wallets on servers. Attacker will be able to take these funds. It's a reasonable measure of an infrastructure security.

majewsky 8y ago
To avoid perverse incentives, you should also build in some reward for the developers/operators. As in: If the server gets hacked, the money goes to the whitehat. If the server does not get hacked for $TIMEFRAME, the money goes to the people responsible for its security.
- chronogram 8y ago
  Seems perverse to me as well. Might be a better idea to just fund Matrix enough to be able to have at least someone full time on it. With $3 752 per month on Patreon right now I cannot imagine it's a lot after infrastructure costs and taxes. Certainly not enough to let Arathorn or someone go out of his way to get expensive security training.
- _red 8y ago
  Also, there is a requirement for the hacker to actually publish the results of how they did it. Otherwise, you run the risk of the hacker just walking away with the funds or giving a bogus reason (after they've already spent the wallet). Therefore, the wallets should be stored GPG encrypted in some published location. After the hacker has successfully penetrated and retrieved the file, they need to publish a "how I did it" document along with the hash of the GPG encrypted wallet. Once devs have confirmed the vulnerabilities exist, they respond with the passphrase to decrypt the wallet.
  - ipoopatwork 8y ago
    Unless I'm missing the joke, this is a bug bounty with extra steps.
    - comboy 8y ago
      My idea was to not require any explanations, so that blackhat could grab that wallet too. It's just about being able to say "this server is $1k secure". I think it's fantastic that we have a technology to do that. You still need some trust that private keys to given wallet are on the server, but apart from that, when you know there's $10,000 dollars on the server for anybody who can access it, it says something about how secure this machine is. Plus you get instant notification when the server is compromised. Not every hacker is kind enough to let you know.
      - KiDD 8y ago
        I like this idea!
      - ipoopatwork 8y ago
        How would a blackhat grab the wallet if it's GPG encrypted and needs the passphrase from the dev?
- alexanderdmitri 8y ago
  Seems like asking for trouble. Basically you're putting a thousand dollars cash in your house, then telling the world I have a thousand dollars cash in my house, if you find a way to break in and take it, it's yours, I won't make a fuss because you're doing me a favor by exposing a vulnerability. Just please don't take the other valuables and ... oh yeah, please don't mess with any of my family members and maybe please let's try to keep it at no more than one hundred people trying at the same time b/c otherwise things might get out of hand.
  - nielsole 8y ago
    You only get the 1000 Euros if you didn't do any of the harmful things you mentioned. It is not"cash" in the house

by comboy 8y ago

majewsky 8y ago

To avoid perverse incentives, you should also build in some reward for the developers/operators. As in: If the server gets hacked, the money goes to the whitehat. If the server does not get hacked for $TIMEFRAME, the money goes to the people responsible for its security.

chronogram 8y ago
Seems perverse to me as well. Might be a better idea to just fund Matrix enough to be able to have at least someone full time on it. With $3 752 per month on Patreon right now I cannot imagine it's a lot after infrastructure costs and taxes. Certainly not enough to let Arathorn or someone go out of his way to get expensive security training.
_red 8y ago
Also, there is a requirement for the hacker to actually publish the results of how they did it. Otherwise, you run the risk of the hacker just walking away with the funds or giving a bogus reason (after they've already spent the wallet). Therefore, the wallets should be stored GPG encrypted in some published location. After the hacker has successfully penetrated and retrieved the file, they need to publish a "how I did it" document along with the hash of the GPG encrypted wallet. Once devs have confirmed the vulnerabilities exist, they respond with the passphrase to decrypt the wallet.
- ipoopatwork 8y ago
  Unless I'm missing the joke, this is a bug bounty with extra steps.
  - comboy 8y ago
    My idea was to not require any explanations, so that blackhat could grab that wallet too. It's just about being able to say "this server is $1k secure". I think it's fantastic that we have a technology to do that. You still need some trust that private keys to given wallet are on the server, but apart from that, when you know there's $10,000 dollars on the server for anybody who can access it, it says something about how secure this machine is. Plus you get instant notification when the server is compromised. Not every hacker is kind enough to let you know.
    - KiDD 8y ago
      I like this idea!
    - ipoopatwork 8y ago
      How would a blackhat grab the wallet if it's GPG encrypted and needs the passphrase from the dev?
alexanderdmitri 8y ago
Seems like asking for trouble. Basically you're putting a thousand dollars cash in your house, then telling the world I have a thousand dollars cash in my house, if you find a way to break in and take it, it's yours, I won't make a fuss because you're doing me a favor by exposing a vulnerability. Just please don't take the other valuables and ... oh yeah, please don't mess with any of my family members and maybe please let's try to keep it at no more than one hundred people trying at the same time b/c otherwise things might get out of hand.
- nielsole 8y ago
  You only get the 1000 Euros if you didn't do any of the harmful things you mentioned. It is not"cash" in the house