►
From YouTube: Filecoin Security and Bug Bounty Program with Deep Kapur
Description
Learn about various efforts to ensure the security of Filecoin and see how you can participate through the Bug Bounty Program to be rewarded for your contributions. Hear about the Security Research Fellowship, through which several community members were able to make substantial contributions to Filecoin.
Join us for Filecoin Liftoff Week, an action-packed series of talks, workshops, and panels curated by the web3 community to celebrate the Filecoin mainnet launch and chart the network’s future.
https://liftoff.filecoin.io/
Events take place all week, October 19-23, 2020. #FilecoinLiftoff
For more information on Filecoin
- visit the project website: https://filecoin.io/
- or follow Filecoin on Twitter: https://twitter.com/Filecoin
Get Filecoin community news and announcements in your inbox, monthly: http://eepurl.com/gbfn1n
Chapters
00:00 Introduction
01:20 Filecoin Security Research Fellowship
03:45 Security Program Overview
06:00 Filecoin Security Website filecoin.security.io
07:15 Audit Reports
11:56 Vulnerability Reporting
14:55 Bug Bounty Program
A
Hey
everyone
thanks.
I
used
to
really
appreciate
it.
I
hope
everybody's
enjoying
the
liftoff
week
so
far.
I
know
we've
had
a
day
full
of
some
really
cool
talks
and
hopefully
you'll
enjoy
this
session
where,
as
ayush
mentioned,
we're
going
to
dig
into
security
a
little
bit
as
well
as
the
bug
bounty
program
that
was
recently
updated.
A
If
you
have
any
questions,
please
post
them
in
the
q,
a
section
I'll
keep
some
time
at
the
end
to
make
sure
that
we
can
address
them.
So
with
that,
let's
get
started
so
I'd
like
to
start
out.
Actually
let
me
do
this
so
in
this
session.
I
want
to
cover
a
few
things
with
you,
so
the
first
is
we're
going
to
talk
a
little
bit
about
the
security
research
fellowship.
A
So
this
is
really
the
start
of
real
community
engagement
with
the
open
source
project
of
ourcoin
to
ensure
that
when
we
reached
mainnet,
it
was
actually
being
done
in
a
secure
and
safe
way
and
that
falcon
was
ready
for
consumption
by
you,
whether
you're,
a
miner
or
a
user
of
the
network.
Second,
we'll
talk
a
little
bit
about
the
overall
security
program
of
far
coin.
We
recently
launched
a
new
website
as
well
and
I'll.
A
Let's
talk
about
the
falcon
security
and
research
fellowship
so
for
those
of
you
that
don't
know
this
was
announced
over
the
summer
earlier
this
year
with
the
intent
that
we
created
a
a
forum
full
of
select
group
of
security,
researchers
or
members
of
the
community.
That
demonstrated
interest
willingness
to
engage
on
the
security
front,
had
the
skills
and
were
willing
to
make
the
time
for
it
with
the
intent
that
they
could
help
us
prepare
the
network
for
maintenance
readiness.
A
So
they
participated
in
a
myriad
of
different
ways
that
included
code
inspections,
stress
testing
the
network
fuzzing,
which
we
also
saw
and
you'll
hear
about
a
little
bit
more
in
our
audit
processes.
But
also
in
like
deep
dives
and
conversations
into
the
theory
and
the
implementation
logic
of
the
actual
network,
we
had
a
very
active
slack
channel
with
them
and
we
learned
a
lot
from
the
experience.
A
So
I
want
to
also
call
out
you
know
a
huge
thank
you
to
the
security
research
fellows
you've
had
a
huge
impact
in
the
way
in
which
the
security
culture
for
coin
is
being
shaped.
You
specifically,
you
know
the
attitude
that
each
of
you
brought
the
mind
space
that
you
created
for
the
conversations
the
behavior
that
you
demonstrated
towards
your
willingness
to
participate,
as
well
as
contribute
towards
far
fun
as
an
open
source
community
and
as
an
open
source.
Blockchain
network
was
awesome.
A
That
includes
a
bug,
bounty
program
and
a
few
other
concepts
so
building
a
strong
security
culture
in
the
falcon
project.
It's
it's
been
a
you
know
core
goal
of
the
project
from
the
very
beginning.
I
don't
know
if
you
saw
some
of
the
prior
presentations
today,
but
a
few
other
folks
have
made
mention
this
wayne,
for
example,
from
the
community
was
also
a
research.
A
Fellow
ayush
also
called
this
out
in
his
previous
presentation,
like
security
is
a
huge
deal
because
security
is
what
allows
somebody
to
actually
have
trust
in
a
system,
and
if
you
don't
have
trust
in
the
system,
then
it's
very
difficult
to
choose
to
participate
in
it.
It's
hard
to
take
a
dependency
on
it.
It's
hard
we're
trying
to
design
the
store
for
humanity's
information,
but
if
people
aren't
willing
to
put
their
data
on
there
because
they
can't
trust
the
network,
then
it's
not
going
to
succeed
in
its
ability
to
do
that.
A
It's
not
going
to
be
able
to
deliver
on
its
promise
and
so
having
a
comprehensive
security
program
is
paramount
to
the
success
of
the
file
coin
technology.
The
protocol,
its
implementation,
the
network
in
any
way
in
which
you
choose
to
engage
so
roughly
speaking,
the
current
state
of
the
security
program
is:
it
includes
rigorous
auditing
both
for
theory
and
for
implementation.
A
But
of
course,
security
for
falcon
as
an
open
source
project
is
also
an
open
source
initiative,
and
so
I'll
show
you
some
links
towards
the
end.
But
we'd
love
to
continue
to
hear
your
feedback.
You
can
share
that
with
us
right
now,
but
also
in
the
future
to
make
filecoin
the
most
robust
data
store
for
humanity.
A
So,
let's
check
out
the
new
website,
I
for
those
of
you
that
didn't
see
the
blog
post
that
went
on
the
falcon
blog
on
monday.
I
believe
so,
just
yesterday,
at
least
in
my
time
zone,
I
know
some
of
you
are
dialing
in
from
different
parts
of
the
world,
so
that
might
not
be
the
case
for
you,
but
we
released
this
new
website
which
you
can
check
out
at
security.falcon.io.
A
I
have
it
open
here
as
well,
but
this
has
got
you
know
it.
This
is
meant
to
serve
as
the
hub
for
like
falcon
security,
like
all
things
related
to
security.
Again,
we're
gonna
continue
iterating
on
this.
So
definitely
would
appreciate
your
feedback,
but
here
you'll
find
information
about
auditing,
about
responsible
disclosure,
the
bug
bounty
program
and
then
any
updates
that
are
coming
out
of
the
overall
security
program,
whether
that's
recently
reported
and
disclosed
issues
or
new
audit
reports
being
released
or
anything
else.
A
So
we
definitely
invite
you
to
check
this
site
out,
participate
in
in
the
way
that
you
feel
comfortable
and
feel
fit
to
and
I'll
refer
to
this
website
a
few
times
through
this
session
as
well.
So
you
know
that
you
should
go
look
at
it
to
get
additional
details
as
are
interesting
to
you,
depending
on
how
you
want
to
participate.
A
I
had
a
couple
of
screenshots
in
case
I
wasn't
able
to
get
the
screen
share
working,
but
that
worked.
So
I'm
gonna
skip
past
this
and
instead
talk
a
little
bit
about
the
specific
parts
that
are
referred
to,
starting
out
with
the
audit
reports.
So
audits
are
super
important
because
they
give
us
the
ability
to
bring
in
a
different
perspective
or
a
different
set
of
eyes,
to
review
both
the
specification
and
the
design
of
the
protocol,
as
well
as
the
implementation
of
the
protocol
and
that's
important
in
ensuring
that
one.
A
A
So
there's
actually
a
section
that
was
added
to
the
file
coin
spec
earlier
this
week
within
the
appendix,
which
has
all
the
published
audit
reports,
with
a
little
description
on
the
scope
of
the
report,
as
well
as
a
link
to
the
report
in
case
you're
interested
in
reading
it.
I
also
snagged
these
two
small
screenshots
from
the
spec
dashboard.
A
There's
a
section
specifically
on
theory
audits
that
will
show
you
sort
of
the
last
date
at
which
we
conducted
an
audit,
whether
that
was
something
that
we
published
on
behalf
of
protocol
labs
or
a
different
organization
within
the
community
or
an
actual
security
firm
that
helped
us
do
it,
as
is
the
case
typically,
especially
with
the
implementation
reports
that
you
will
see
in
in
the
implementation
status.
Dashboard
yeah
so
definitely
check
out
this
section.
Please
read
the
reports.
A
A
This
is
actually
accurate.
This
works
the
way
that
we
want
it
to,
and
so
please
continue
to
also
expect
more
and
more
audits
to
continue
to
happen
to
different
parts
of
our
coin
and,
of
course,
as
we
get
more
fips
as
different
parts
of
the
code
base
continue
to
evolve
and
change.
So
will
there
have
to
be
reports
and
auditing
done
on
those
new
versions
or
iterations
to
ensure
that
we're
continuing
to
push
file
coin
interaction
that
it
stays
useful,
but
also
trustable
and
secure.
A
The
best
way
to
do
that
is
by
looking
at
the
security
side
or
checking
the
audit
section
inside
the
spec,
as
I
mentioned
before,
with
that,
I
also
wanted
to
take
a
second
to
thank
the
security
partners
that
we've
been
working
with
over
the
last
years.
You've
been
excellent
partners
to
work
with.
We've
learned
a
lot
from
you,
but,
more
importantly,
you
have
done
a
very
critical
job
in
ensuring
that
the
filecoin
network
at
its
state
today
at
mainnet,
is
something
that
is
safe,
is
secure,
usable
and
delivers.
A
Let's
talk
a
little
bit
about
the
vulnerability
reporting
side
of
things.
Typically,
if
you
find
an
issue,
the
right
place
to
go
to
is
the
github
issues
in
the
repository
that
that
issue
belongs
to.
However,
in
the
case,
that
you
find
something
that's
an
actual
security
vulnerability
that
could
be
exploited
and
would
harm
either
the
user
experience
or
the
state
of
truth
or
the
actual
protocol
in
the
network.
A
Then
we'd
like
you
to
report
in
a
way
that
we
can
follow
up
on
it
and
ensure
that
it
doesn't
result
in
negative
externalities
on
the
overall
network.
So
the
two
ways
that
you
can
do
this
one.
You
can
email
us
at
security,
falcon.org
and
please,
you
know,
feel
comfortable
to
encrypt
the
information,
especially
if
there's
sensitive
information
there's
a
gpg
key
that
we've
published.
A
Of
course
you
can't
click
on
the
link
here,
but
the
link
is
on
the
website,
as
well
as
in
a
couple
of
different
places
that
should
make
it
fairly
discoverable
yeah,
please
encrypt
the
information
and
send
it
to
us
and
that's
one
very
easy
way,
and
I
guess
quick
shout
out
to
that
email
address.
Of
course
we're
monitoring
it.
A
So
for
those
of
you
that
aren't
familiar
key
base
within
key
base,
we
actually
have
a
team
called
filecoin
underscore
sec
or
short
for
security
that
you
can
request
to
join
where
me,
or
somebody
else
from
the
admin
team
will
accept
your
your
request
and
then
you
can
create
a
one-on-one
channel
or
a
private
channel
between
you
and
one
of
us
to
ensure
that
there's
a
safe
and
secure
way
in
which
you're
able
to
communicate
with
us.
This
is
also
you
know.
A
And
in
that
vein,
I'd
also
like
to
call
out
our
disclosure
policy.
We've
gone
with
something
called
a
coordinated
disclosure
policy
by
which,
specifically,
a
researcher
can
share
the
details
of
a
vulnerability
after
a
fix
has
been
applied
and
our
security
team
is
provided
permission
to
disclose.
So
if
you're,
a
researcher
and
you've
found
something,
that's
actually
a
critical
issue
or
security
issue
with
a
network,
we
ask
you
to
wait
to
disclose
until
we
have
reached
the
point
that
with
high
confidence
that
a
fixes
fix
can
be
rolled
out.
A
We're
obviously
going
to
do
our
best
to
do
that
as
fast
as
possible.
But
we
also
expect
to
be
in
close
communication
with
you
and
so
we'll
work
with
you
on
a
timeline
by
which
you
can
also
report
your
findings.
We
can
also
disclose
the
vulnerability
officially
from
the
falcon
project
site
with
that.
A
So
if
you've
engaged
with
us,
please
share
any
feedback
that
you
have
about
the
bounty
program
about
the
information
available
on
the
bounty
program.
We
do
want
to
make
it
as
easy
and
as
safe
as
possible
for
you
to
continue
reporting
vulnerabilities,
because
we
want
to
make
it
so
that
the
falcon
network
can
continue
to
stay
safe
without
increasing
the
friction
that
it
takes
to
do
that.
A
So
let's
talk
about
what
it
means
to
be
participating
in
the
bug
bounty
program,
so
one
as
we
discussed
before,
there's
safe
ways
for
you
to
report
your
findings.
But
it
should
also
be
noted
that
if
you're
a
researcher
you
are
protected
by
safe
harbor
policy,
which
means
within
the
right
limits.
We
do
want
you
to
stress
the
system
and
and
push
it
in
different
ways,
and
you
should
feel
comfortable
doing
that.
A
You
can
read
the
specifics
of
this
on
the
bounty
website
where
we
detail
what
the
safe
harbor
policy
actually
entails
in
terms
of
the
rewards
that
you
get
we're,
probably
going
to
go
with
a
point
system.
Well,
not
probably
we
are
going
with
the
point
system
where,
depending
on
the
level
of
severity
of
the
issue,
we
will
assign
a
certain
number
of
points.
A
Those
points
currently
map
directly
one
to
one
to
us
dollar,
but
the
points
are
also
interesting
because
we'd
like
to
be
tracking
a
leaderboard
of
sorts
over
time,
so
that
this
also
becomes
a
community
within
the
larger
film
community,
where
security
researchers
can
see
their
progress
and
see
how
their
contributions
are
stacking
up
to
the
falcon
network
relative
to
others
that
are
participating
in
the
program.
And
currently
we
want
this
bounty
program
to
be
open,
so
we
haven't
set
an
end
date.
A
This
is
likely
going
to
stay
the
case
because
it's
important
to
ensure
that
you
know
in
the
limit
falcon
continues
to
be
a
safe
and
secure
network,
and
so,
whatever
you're
willing
to
do
in
terms
of
the
time
that
you
can
make
and
the
expertise
that
you
can
bring
we'd
love
to
have
it.
The
security
side
has
a
subsection
specifically
on
the
bounty
program,
which
has
these
details,
some
additional
rules,
policies-
and
you
know
all
the
links
that
you've
seen
in
my
slides.
You
can
obviously
click
on
them
there
and
learn
more
as
needed.
A
The
scope
of
the
program
is
set
to
the
core
protocol
and
its
implementations.
As
well
as
many
of
their
dependencies,
so
a
couple
of
highlight
repositories,
lotus
actors,
the
proving
system
and
tons
of
others
there's
a
massive
list
of
repositories
that
we're
calling
in
in
scope,
and
that's
because
we
want
as
much
coverage
as
we
can
get.
A
So
if
you
see
any
especially
the
third
party
and
put
up
by
other
community
members,
they're,
definitely
out
of
scope
and
the
last
bit
that's
worth
calling
out
is
if
a
vulnerability
was
publicly
disclosed
instead
of
via
one
of
the
secure
channels
or
if
an
issue
that
you're
calling
out
was
also
reported
either
to
us
already
or
via,
like
a
security
audit,
where
it's
eventually
been
published,
then
those
obviously
won't
count
for
reward.
So
it's
it's
worth.
A
A
So
definitely
keep
an
eye
out
on
that.
The
last
two
I
wanted
to
call
out
are
on
test
ground
and
test
vectors,
so
test
factors.
Is
this
awesome
repository?
I
don't
take
up
too
much
time
talking
about
it.
Instead,
what
I'll
do
is
I'll
refer
you
to
a
session
that'll
happen
at
1
pm
on
wednesday
at
utc
time,
so
I
believe,
that's
like
in
11
and
a
half
ish
hours
by
one
of
the
pll
team
members
named
raul.
A
He
has
some
awesome
stuff
to
share
with
you
about
ways
in
which
you
can
contribute
to
the
test
suite
for
far
coin.
So,
if
you're
somebody
who's
in
the
security
space,
that's
finding
issues
vulnerabilities
and
wants
to
help
contribute
to
the
long-term
solution,
ensuring
that
they
actually
do
get
fixed
then
also
contributing
a
test
vector
alongside
your
report
is
an
awesome
way
to
do
this
and
will
also
bump
up
the
reward
that
you
get
for
your
time
and
then
test
ground.
There's
also
a
session
on
this.
A
You
should
check
that
out
to
see
how
you
can
create
a
testing
environment
for
yourself,
so
you
can
probably
reproduce
the
bug
that
you
may
have
seen
once
you
decide
that
you
found
something
that's
worth
reporting
so
with
that
thanks
so
much
for
your
time.
Happy
bug
hunting
looking
forward
to
engage
in
whatever
way
is
comfortable
for
you.
You
can
find
me
on
twitter,
github,
email
or,
of
course,
on
the
filecoin
slack.