►
Description
For the 21st episode of CULPS as we hear from the proposed Immunefi Core Unit team. This Core Unit Launch Pod Session marks the first extensive collaboration between decentralized organizations.
Immunefi is the largest bug bounty platform in Crypto, and its co-founder -Travin Keith @travinimmunefi - is slated to be this Core Unit’s facilitator.
In this episode, we will learn how Immunefi can systematically improve security for builders, end users, and other stakeholders in the Maker Ecosystem by providing both reactive and proactive security services.
Full agenda: https://forum.makerdao.com/t/core-unit-launch-pod-sessions-session-21-immunefi-security-core-unit/11560
Contact info:
Travin Keith
Forum - @travinimmunefi
Discord Handle: Travin Keith | Immunefi#3586
Joshua Pritikin
Forum - @psychonaut
Discord Handle: psychonaut#7023
Discord Channels:
Chat.MakerDAO.com
SES - ses.makerdao.network/Discord
Immunefi - Immunefi
A
All
right,
well,
hello,
everyone
and
welcome
to
the
21st
episode
of
core
unit
launch
pod
sessions.
I'm
retro
a
contributor
with
the
sustainable
ecosystem
scaling
core
unit
at
maker,
dao
and
today,
I'm
joined
with
the
proposed
core
unit
team
for
amunify
mutify's
proposal
is
currently
in
the
formal
submission
phase
with
about
five
days
left
with
over
50
000.
A
B
B
Perfect
so
hi,
I'm
trayvon
keats,
I'm
one
of
the
co-founders
of
emunify.
First
I'd
like
to
apologize,
I'm
a
bit
sick
at
the
moment.
Unfortunately,
our
bug
bounty
program
doesn't
deal
with
health
bugs,
but
I
hope
we
get
to
that
soon,
because
it's
annoying
working
on
sick
yeah.
We
have
the
mission
to
just
basically
systematically
improve
security
for
builders,
end
users
and
other
stakeholders
by
providing
both
reactive
and
proactive
security
services
to
the
maker
ecosystem.
B
This
is
very
different
from
what
we're
usually
doing
a
lot
of
what
we
do
is
slightly
proactive
and
slightly
reactive.
It's
focused
just
having
a
bug
program
for
our
clients,
and
so
this
is
a
little
bit
of
a
new
expansion
for
us
and
we're
happy
to
be
working
with
the
maker
ecosystem
for
it,
as
retro
mentioned,
there's
a
collaboration
between
decentralized
organizations
where
we
want
to
try
to
scale
growth
the
right
way.
B
It's
been
brought
up
a
lot
during
the
rfc
period.
Where
you
know
there
were
questions
of.
Why
are
you
becoming
a
core
unit?
Why
don't
you
just
be
a
regular
third
party
supplier,
other
organizations
that
have
been
doing
that
for
maker,
whether
as
a
foundation
or
as
after
decentralization
have
asked
us?
Why
we're
also
doing
the
salmon
one
is
because
we
want
to
be
more
proactive.
You
know
if
we're
just
a
third-party
supplier,
we
tend
to
be
reactive.
B
We
have
to
wait
for
the
respective
core
units
to
reach
out
to
us
and
if,
as
the
ecos-maker
ecosystem
grows,
there's
going
to
be
more
core
units,
we
have
to
wait
for
them
to
reach
out
to
us
or
wait
for
somebody
to
say
like
hey.
I
think
this
core
unit
could
use
your
services
by
being
a
core
unit
ourselves.
B
We
then
get
more
immersed
into
the
ecosystem
and
yeah.
We
start
proactively
looking
for
ways
in
order
for
us
to
improve
the
security
of
the
ecosystem
as
a
whole.
The
second
part
is
continuity.
So,
for
example,
I
myself
I'm
one
of
the
co-founders
of
immunify.
If
we
were
just
a
third-party
supplier,
you
know
it
could
just
be
that
somebody
else
takes
my
role,
because
I
say
as
a
co-founder,
I
need
to
jump
over
to
something
else.
B
B
Therefore,
we're
able
to
put
the
ecosystem's
needs
first
and
not
just
saying
you
know,
as
an
overall
business
decision
of
immunify.
So
I
know
it's
also
a
risk
from
our
side,
so
we
also
had
to,
of
course,
to
talk
to
some
people
from
our
investors
and
my
colleagues
and
yeah,
but
I
think
that
this
is
really
the
best
way
forward
and
we're
happy
that
maker
ecosystem
has
welcomed
us.
So
far
with
you
know
pushing
this
forward.
B
So
a
little
bit
of
background,
so
unified
is
the
largest
bug
banning
program
in
the
crypto
ecosystem.
We've
prevented
about
two
billion
dollars
in
loss
of
funds
just
a
few
weeks
ago.
This
was
actually
of
just
around
a
billion,
but
a
bug
report
for
polygon
was
disclosed
on
our
platform,
which
prevented
a
loss
of
850
million
dollars.
B
We
currently
have
currently
have
about
57
million
in
rewards
available
for
just
the
critical
vulnerabilities
that
includes
both
smart
contract
and
blockchain
vulnerabilities,
as
well
as
web
and
app
vulnerabilities,
and
so
far
we've
paid
out
7.5
million
dollars
in
rewards.
So
we've
encouraged
a
lot
of
projects
to
have
reasonable
bugberry
programs
that
match
more
with
regards
to
the
damage
that
can
be
done
and
we're
happy
that
both
sides,
both
the
hackers
and
the
projects,
have
been
very
happy
to
push
this
growth
forward.
B
We've
have
experimented
with
providing
additional
services
in
the
past,
so
one
thing
I'll
be
talking
over
a
bit
later
is
the
operational
audit,
which
we've
called
in
the
past
as
a
full
spectrum.
Security
audit
and
we've
also
done
more
room
and
incidence
response,
but
we
haven't
really
fully
packaged
this,
but
this
is
something
that
we'll
be
doing
for
the
maker
ecosystem
and
yeah,
we'll
be
providing
other
services
as
well
in
a
more
proactive
manner,
we'll
be
actively
looking
into
ways
that
we
can
provide
additional
value
as
a
core
unit
to
make
our
ecosystem.
B
B
Additionally,
we'll
also
be
collaborating
with
other
third
party
suppliers,
which
we
will
be
talking
over
in
this
presentation
later
on,
but
first
more
about
myself.
As
I
mentioned,
I'm
one
of
the
co-founders
of
emunify,
together
with
two
others
duncan
townsend
who's,
our
cto
and
mitchell,
amador
who's,
our
ceo
I've
been
working
full-time
in
the
cryptocurrency
space
now
for
over
five
years
actually
began
that
time.
B
While
I
was
living
in
the
arctic
in
long
air
being
svalbard
and
haven't,
looked
back
since
been
very
happy
with
that
decision,
I've
been
an
independent
consultant
for
a
wide
multitude
of
projects,
both
centralized
and
decentralized,
ranging
from
startups
all
the
way
to
government
organizations.
So
I
actually
did
a
project
with
the
european
commission.
A
few
years
ago,
I've
had
a
lot
of
experience
around
open
source
and
open
organic
organizational
aspect
around
open
source.
So
I've
been
a
contributor
to
the
open
source
initiative.
B
C
Yeah,
so
so
I
have
about
30
years
of
software
engineering
experience.
I
got
a
phd
in
quantitative
psychology
about
about
10
years
ago,
and
that
was
early
2017
maker
investor
and
community
participant
I've
been.
I
haven't,
done
any
like
software
development
for
maker,
but
I've
been
participating
in
the
forums
and
and
chat
pretty
consistently
since
then
and
kind
of
the.
The
thing
I
wanted
to
highlight
in
in
my
role.
C
My
role
in
the
in
this
core
unit
is
that
I'm
not
employed
elsewhere,
and
so
I'm
like
100
percent
maker
aligned
and
so
that
so
that
makes
me
kind
of
like
the
the
connector
between
maker
interests
and
the
third
parties
that
we're
contracting
with,
and
so
so
I
I
think
I
think,
I'm
in
an
important
piece
of
that
of
of
of
kind
of
stitching
together
all
these
organizations-
and
I
was
also
recruited
by
one
from
the
ses
core
unit
so
yeah.
So
that's
a
little
bit
about
me.
B
So
I
talked
about
some
external
partners
that
will
be
helping
us
out,
so
one
is
chain.
Security
they've
actually
been
working
with
maker
for
quite
some
time
now.
So
I'm
sure
you
guys
know
about
them
fairly.
Well,
yeah
they're,
quite
a
reputable
auditing
firm
here
in
switzerland,
and
so
for
me,
I'm
also
very
close
to
them
geographically.
B
So,
if
ever
I
do
need
to
get
to
them,
I
can
just
take
a
30
minute,
train
ride
or
drive
and
knock
on
their
door
and
scream
at
them
if
they
need
something
we're
also
working
with
d5
safety,
so
they
provide
security
scoring
for
various
d5
projects.
They've
been
working
with
a
lot
of
different
security
services
that
they've
been
considering
and
we're
happy
to
work
with
them
to
essentially
take
that
into
the
market,
and
they
have
a
lot
of
security
background
experience,
so
we're
happy
to
bring
their
expertise
over
to
this
core
unit
as
well.
B
We
plan
to
achieve
this
to
two
main
areas:
one
is
security
operations
and
two
is
community
support
I'll
be
going
over
each
of
these
individually.
So
for
security
operations,
it's
the
identification
of
critical
infrastructure,
the
creation
of
a
bug,
bounty
program,
of
course-
and
the
third
is
incident
response
facilitation.
B
The
identification
of
critical
infrastructure
is
just
basically
where
we
try
to
create
a
list
of
critical
people
and
infrastructure
around
the
maker
ecosystem,
where
we
need
to
track
that
information
as
well
as
to
set
up
proper
monitoring
tools,
basically,
so
that
we
can
make
sure
that
we
would
know
if
an
attack
is
happening
if
something's
going
wrong
and
if
things
are
relying
on
other
things.
There
have
been
some
cases
before
where,
let's
say
a
is
a
very
critical
component
of
security,
but
relies
on
something
around
b
and
which
b
relies
on
c.
B
So
therefore,
c
it
becomes
part
of
that
critical
infrastructure,
even
if
it
doesn't
directly
get
identified
itself
as
something
that's
critical
and
we'll
be
doing
this
in
collaboration
with
d5
safety.
As
I
mentioned,
they've
had
some
different
scoring
mechanisms
that
they've
been
implementing
throughout
various
d5
protocols,
as
well
as
their
own
security
expertise
to
identify
all
of
these
and
to
be
able
to
make
some
proper
prioritizations
with
the
bug
dynamic
program,
of
course,
because
we're
immunify
we'll
be
also
creating
an
industry
leading
bug.
B
Bounty
program,
that'll
really
put
maker
dow
up
top
with
all
of
the
expertise
that
I've
had
so
I've
actually
written
the
drafts
of
over
ninety
percent
of
all
of
the
bug.
Bounty
programs
on
immunify
I've
been
the
one
who's
having
to
deal
with
a
lot
of
the
unique
issues
between
hackers
and
projects.
So
I
will
make
sure
that
the
bug
benny
program
for
maker
dow
is
really
top
of
the
line
and
industry
best
we'll
be
also
working
with
chain
security
for
additional
triaging
for
these
bug
reports.
B
So
we
ourselves
will
also
be
doing
the
triaging
of
the
bug
reports
for
initial
filtering.
Normally
we
just
provide
light
filtering,
but
in
maker
now's
case
we'll
actually
be
delving
deeper
into
the
bug
report,
making
sure
that
it's
actually
something
of
substance,
and
once
we
determine
it,
it
is
something
of
substance,
but
because
of
course,
we
don't
have
in-depth
knowledge
of
the
maker
dow
ecosystem
as
a
whole,
we'll
be
sending
that
over
to
chain
security.
B
Who
then,
has
that
expertise
to
further
triage
that
bug
report
before
sending
it
over
to
the
relevant
core
unit
after
the
bug
report
is,
of
course,
submitted
and
fixed,
and
the
hackers
paid
out
we'll
be
also
happy
to
write
a
postmortem
we've
been
doing
this
for
a
lot
of
our
clients.
Fake
protocol
is
one
of
them.
You
can
take
a
look
at
our
medium
blog
page,
where
you
can
see
all
of
the
postmortems
that
we've
done
for
our
various
clients.
B
It's
a
really
great
way
to
create
additional
transparency
in
the
space,
because
it
goes
over
the
bug.
It
goes
over
details
around
the
bug,
valley,
payout
and
yeah.
It
just
basically
puts
everybody
in
a
good
light,
depending
on
the
circumstances
around
the
bug
report.
We
can
even
provide
some
pr
assistance,
of
course,
be
working
with
the
pr
core
unit
and
the
relevant
core
units
involved
to
make
sure
that
really
maximum
positive
effect
can
be
reached.
By
having
this,
you
know,
bug
report
come
out.
B
So
basically,
then,
after
this
bug
report,
everybody
is
a
step
forward,
at
least,
and
third
under
security
operations
is
the
incidence
response
facilitation.
Sometimes
this
is
called
this
war
room.
I
prefer
incidence
response
because
it
gets
a
little
bit
less
of
a
military
mindset,
but
basically
this
is
having
a
set
of
procedures
and
coordination
in
the
event
of
an
actual
black
hat
attack
on
the
maker
ecosystem,
whether
that
be
stealing
funds
directly
or
permanently
freezing
funds,
or
even
temporarily,
freezing
funds.
B
I
understand
that
there's
a
lot
of
work,
that's
already
being
done
by
various
core
units
and
we're
looking
forward
to
collaborating
with
them.
It's
one
thing
I
want
to
emphasize.
I
know
that
some
of
these
things
have
already
been
done
by
other
core
units
and
we
we're
not
looking
to
to
compete
against
other
core
units.
We
are
absolutely
going
to
collaborate,
we're
trying
to
make
sure
that
what
we
do
matches
into
the
ecosystem,
so
yeah
we've
done
this
before
primitive
finance
was
the
first
one
that
we've
done.
B
We've
done
a
couple
of
more,
but
I'm
not
allowed
to
talk
about
them.
Unfortunately,
but
let's
just
say
it's
gotten
to
the
point
that
whenever
somebody
calls
me
and
say:
okay
there's
an
emergency,
I
don't
go.
Oh
no!
I
say:
oh
here
we
go
again
but
of
course
we'll
be
getting
other
people
to
help
out
with
that
as
well.
So
don't
worry,
it
won't
just
be
reliant
on
me.
B
Joshua,
of
course,
as
the
deputy
facilitator
will
also
be
there,
unified
services
and
as
well
as
our
other
third
parties
will
get
involved
now
on
to
the
community
support
side.
So
it's
two
things.
One
is
the
core
unit
operational
audit.
So
this
is
the
full
spectrum
security
audit
that
I
mentioned,
and
the
second
part
is
education
and
advisory
with
the
operational
audits,
it's
basically
an
audit
of
everything
other
than
the
software
code.
So
we
go
over.
You
know,
hardware
choices.
How
do
you
get
code
published?
B
B
So
these
are
two
very
different
approaches,
of
course,
with
the
core
units.
It's
something
that's
going
to
be
more
specific
towards
them,
operating
as
a
core
unit,
so
this
will
be
things
like
core
unit
office
hours,
where
we're
kind
of
just
on
call,
and
we
can
answer
the
questions
as
well
as
we
just
create
content
proactively
that
we
find
that
could
be
useful
for
them
and
for
the
wider
maker
ecosystem
community.
It
can
just
be
things
with
like
how
to
stay
secure
on
discord,
how
to
stay
secure
on
telegram.
B
We've
already
had
some
of
this
content
published
sort
of
like
this
on
our
medium
blog
and
we'll
try
to
make
that
more
specific
towards
the
maker
ecosystem,
so
yeah,
those
are
all
of
the
five
services
that
we'll
be
providing
as
a
new
phi
security
core
unit.
Again,
as
I
mentioned,
we'll
be
very
proactive
about
this.
B
So
in
december
we
anticipate
our
core
unit
launch
assuming
a
full
positive
vote
and
we'll
be
also
proposing
posting
sorry,
our
bug
bounty
program,
mip.
Sorry,
I
was
just
corrected
recently
that
it's
actually
going
to
be
a
separate
map.
It's
not
going
to
be
considered
both
a
sub-proposal,
given
that
it's
a
very
separate
thing
and
yeah
we'll
be
starting
to
set
up
weekly
calls
for
office
hours
and
general
update
calls.
B
We
probably
won't
have
a
lot
in
december,
given
the
holidays,
but
we'll
probably
try
to
at
least
have
one
and
maybe
have
it
a
little
bit
holiday
themed
and
we'll
be
launching
our
community
channels.
Also
during
that
time,
one
of
them
will
be
within
the
unified
discord
and
will
be
specifically
for
the
maker
dao
unified
security
core
unit.
B
In
january,
we
plan
to
have
the
formal
submission
of
the
bhagbani
program
mip
and
finalize
certain
initial
incidents
response
procedures.
We've
already
started
that
so
that
beginning
work
on
that
was
in
october,
and
we
hope
to
finalize
a
lot
of
this
by
january
by
the
end
of
january
and
yeah.
We
was
also
aimed
to
complete
the
identification
of
the
various
metrics
that
need
to
take
into
account
for
to
detect
nefarious
activity
and
yeah
to
have
our
first
regular
content
publication.
In
january.
B
In
february
we
plan
to
organize
the
creation
of
backups
for
the
various
critical
monitoring
infrastructures,
so
it
is
part
of
the
critical
infrastructure
identification.
But
then
this
part
is
more
about
setting
up
to
make
sure
that
those
areas
are
properly
monitored
at
all
times
and
we're
also
going
to
commence
the
first
fire
drill.
So
we
haven't
decided
yet
exactly
how
we're
going
to
do.
This
is
something
I'll
be
working
with
defy
safety
for,
but
yeah.
B
We
also
plan
to
launch
the
bug
banning
program
during
that
time,
of
course,
coordinating
with
pr
teams
so
that
we
can
make
sure
to
get
the
most
out
of
this
and
yeah
begin
the
core
unit,
operational
audits,
for
at
least
two
core
units.
We
will
be
hopefully
providing
that,
at
least
by
the
end
of
february.
B
We
might
have
more
core
units,
if
determined
necessary
throughout
our
feedback
gathering
process,
but
at
least
we
aim
for
at
least
two
one
quick
answer:
a
comment
with
regards
to
bug
bounty
program.
There
is
no
additional
costs
or
anything
like
that
for
onboarding
on
immunify,
as
with
all
of
the
other
breakdown
programs,
there's
no
onboarding
fee
for
us.
B
Speaking
of
fees,
here's
a
quick
overview
about
our
budgets,
so
our
quarterly
budget
comes
out
to
122
thousand
dollars,
including
the
contingency
buffer
of
15.
Just
a
quick
note
with
regards
to
chain
security.
That
is
a
consumable
expense.
So
if
ever
they're
they're
not
called
in
you
know
they
don't
get
paid.
Basically,
we
continue
on
the
agreements
that
are
currently
in
place
together
with
protocol
engineering,
but
we
basically
just
take
it.
B
B
Our
yearly
expense
is
just
basically
the
company
setup.
It
comes
out
to
two
thousand
five
hundred
dollars.
I
was
able
to
get
a
pretty
good
deal.
We
won't
be
going
over
full
details
around
that,
but
I
can
definitely
say
that
we
will
have
that
set
up
before
the
anticipated
core
unit
launch
and
we
have
certain
one-time
expenses
as
well.
B
So
we
have
some
hardware
and
software
expenses
and
also
with
chaos
labs,
so
the
hardware
and
software
expenses
you
can
see
further
on
the
budgeting
map,
but
basically
it's
any
hardware
and
software
that
we
deem
could
be
beneficial
for
the
community
or
that
we
need
to
use.
So
we
were
actually
hoping
to
use
a
special
video
conferencing
tool
for
for
this
call,
but
unfortunately,
because
of
certain
issues
and
it
being
more
focused
for
a
private
discussion
rather
than
an
open
seminar
type
of
thing.
B
B
Basically,
it's
a
a
tool
that
that
we
will
be
able
to
provide
to
the
bug
bounty
hunter
so
that
they
can
properly
set
up
a
dev
environment
to
look
for
bugs
on
maker
dial
and
yeah
with
a
contingency
buffer
that
comes
out
to
seventy
thousand
and
seven
hundred
twenty
five
dollars
and
I'll
hand
it
over
to
joshua.
To
talk
more
about
the
mkr
expenditures.
C
Yeah,
so
the
this
corn
core
unit
really
only
has
myself
and
trayvon
as
being
kind
of
holding
the
fort
so
to
speak,
and
then
we're
going
to
be
coordinating
between
maker,
dao
and
c
and
and
in
like
d5
safety
and
chain
security.
These
these
other
organizations,
so
the
the
maker
incentive
is,
will
will
only
be
given
to
trayvon
and
myself
and
we're
following
the
schedule
recommended
by
scs.
C
C
If
we
bring
on
new
people
or
if
one
of
us
leaves
then
then
this
budget
will
be
adjusted
to
because
these
these
amounts
are
for
the
individuals
working
not
for
the
core
unit.
So
you
know
it
should
be
pretty
straightforward
to
the
like.
This
is
this
is
a
kind
of
like
a
standardized
following
a
standardized
spreadsheet
that
ses
provided
me.
That's
where
I
got
these
estimates.
So
that's
all
I
wanted
to
say
about
it.
B
Awesome,
thank
you
very
much,
so
here's
some
frequently
asked
questions
that
was
provided
to
us,
either
in
private
or
public
throughout
the
rfc
period,
so
I'll
just
quickly
go
over
them
before
we
open
things
up
to
more
questions
one.
Why
is
this
a
core
unit,
as
I
mentioned,
to
start
just
a
way
for
us
to
be
way
more
productive,
proactive
in
the
ecosystem,
because
then
we
are
part
of
the
ecosystem
instead
of
just
being
an
outsider.
Providing
a
service.
Second
is
continuity.
B
B
How
are
the
third-party
payments
structured
so
with
chain
security?
I
already
mentioned
that
with
d5
safety,
they
essentially
have
bulk
hours
that
we
purchase
as
we
need,
so
there's
actually
a
chance
if
we
don't
need
so
many
hours
that
we
won't
even
use.
A
lot
of
you
know
the
full
year
estimate,
but
rather
less
than
that,
so
it's
on
as
needed
basis
and
with
chaos
labs
it's
based
on
usage.
B
B
It's
very
different
from
the
regular
budgeting
as
a
whole,
so
you'll
see
further
on
how
unique
this
is
once
we
post
that
on
the
forum
as
a
request
for
comments
about
how
unique
yeah
yeah
the
payments
will
end
up
being,
it's
not
something,
of
course,
that
you
can
just
pay
in
advance
and
then
wait
and
hold
on
to
and
then
pay
out
as
needed,
so
yeah
because
of
its
complexities.
We
just
determined
it
to
be
best
to
be
something
separate
entirely.
B
The
processes
involved
in
it
is
also
going
to
be
a
little
bit
different
and
yeah.
I
can't
share
too
much
here
because
a
lot
of
it
hasn't
been
finalized.
I
can't
go
in
depth,
but
you'll
be
able
to
see
this
in
december,
so
yeah.
Thank
you
very
much
for
for
listening
and
attending
here
very
happy
again
to
speak
in
front
of
the
maker
ecosystem.
B
I've
been
a
not
really,
I
wouldn't
say,
like
passionate
follower,
because
that
would
be
lying,
but
I've
been
somebody
who's
identified,
how
maker
kind
of
pushed
through
the
early
years,
where
even
I
was
one
of
the
skeptics
so
very
happy
to
propose
this
core
unit
to
the
ecosystem
and
happy
to
receive
all
the
support
that
we've
gotten
so
far
and
yeah.
We
can
open
things
up
to
more
questions
now.
A
Great
well,
thank
you,
travin
and
joshua
for
that
detailed
explanation.
One
of
the
more
thorough
core
unit
launch
pod
sessions
in
terms
of
providing
a
schedule
and
cadence
for
the
initial
launch
of
the
core
unit.
If
anyone
does
have
questions,
please
go
ahead
and
post
them
in
the
chat
and
we
can
work
to
unmute
you
or
ask
them
main
question
that
I
have
is
related
to
the
bug.
B
You
know
they
have
large
rewards,
but
the
documentation
is
just
often
I
mean
hackers
when
they,
when
they
start
working
on
a
bug,
bounty
program,
you
know
they're
not
guaranteed
a
payment
if
they
only
get
paid
if
they
find
something-
and
they
have
to
invest
so
much
time,
just
understanding
how
everything
works
and
if
you
can
get
that
time,
shorter
it'll
invite
more
people
to
look
into
the
bugberry
program
and
actually
be
able
to.
You
know.
Take
that
risk.
I
mean
especially
maker
dao.
It's
such
an
established
protocol
compared
to
all
of
the
others.
B
It's
it's
actually
quite
daunting
for
a
lot
of
the
hackers.
So
if
they're
gonna
see
like
okay,
it's
makered
out-
and
I
have
to
do
all
of
this
work
just
to
get
a
chance
to
get
a
reward-
it's
gonna
really
discourage
them,
and
so
yeah.
That's
something!
I'm
gonna
address
head
on
to
make
sure
that
everything
is
as
smooth
and
streamlined
as
possible.
B
So,
that's
not
something
that
we're
actively
looking
into
at
the
moment,
mainly
because
the
relationship
with
the
existing
auditors
is
quite
positive,
at
least
from
what
I've
seen.
So
we
kind
of
don't
want
to
again.
You
know
we
don't
want
to
compete
where
we
can
just
collaborate,
so
we're
happy
to
collaborate
with
chain
security
in
this
regard.
B
With
regards
to
addressing
the
long
wait
times
with
the
various
auditing
firms,
it's
something
that
we're
seeing
you
know,
industry-wide,
building
an
auditing
team
in-house
is
gonna,
be
something
that's
quite
big,
so
I
mean
we're
happy
to
collaborate
with
other
core
units
if
that's
really
deemed
something
that's
necessary
and
again.
This
is
something
that
you
know:
we're
open
to
feedback
for
from
other
core
units
and
we
can
see
where
we
can
come
in
to
help
out.
A
Awesome
question
david:
I
appreciate
that
another
question
that
comes
to
mind
or
something
that
I'd
love
to
have
some
more
detail
on
is
the
process
surrounding
defining
the
security
risks
for
the
personnel.
Like
you
mentioned,
you
have
multiple
cell
phones
and
laptops.
What
what
are
some
of
the
the
steps
that
you're
envisioning,
I
guess
initially
that
you
identified
that
can
make
makers,
personnel
security,
more
robust.
B
It's
threat
modeling,
first
and
foremost,
like
the
reason
why
I
have.
All
of
this
is
one
partly
for
fun.
I
know
my
idea
of
fun
is
very
different
for
most
people,
but
another
is
like
yeah.
What
are
these
people
involved?
With?
I
mean
if
it's
somebody
who
is
not
in
charge
of
publishing
code,
they
don't
need
a
privacy
based
device.
B
If
it's
somebody
who
does
not
have
one
of
the
keys
to
the
multisig
okay,
they
don't
need
to
have
a
separate,
dedicated
device
just
for
the
2fa
for
communication
access,
because
I
don't
want
that.
You
know
you
know
if
they
are
actually
releasing
keyholder,
then
communication
communications
with
other
keyholders
becomes
very
relevant
if
they're
not
part
of
that
at
all,
their
security
requirements
are
much
less
so
yeah
it
which
we're
gonna
try
to
make
this
very
practical.
B
So
yeah
that
that's
how
we're
envisioning
it's
going
to
scale
we're
going
to
make
sure
it
scales
adequately.
We
understand
that
you
know.
I've
worked
in
tech
support
before
you
don't
want
to
implement
a
system
that
sounds
secure
but
can
be
implemented
absolutely
horribly.
You
have
to
be
very
understanding
with
the
human
aspect
of
it.
I'm
not
a
developer,
so
I
you
know
I
have
to
think
about
that
to
myself.
B
Sometimes,
although
I
failed
granted
a
few
times
and
bricked
my
phone
almost
breaking
my
phone,
not
understanding
where
my
limits
lie,
but
that's
at
the
at
the
forefront
of
my
thought
and
I've
talked
to
joshua
as
well
about
this.
A
lot
of
the
reasons
why
I
really
liked
him-
and
you
know
very
happy
with
the
introduction
from
one-
is
that
he
also
has
the
very
very
much
the
same
mindset
here.
We
don't
want
to
make
people's
lives
difficult.
C
Maybe
I
could
just
add
a
little
bit
there
is.
You
know
in
my
career
as
a
software
developer,
I've
I've
mostly
been
on
the
other
side
of
the
fence
like
like
the
security
guys
were
always
a
pain
in
the
neck
and
and
asking
me
to
do
things
I
didn't
want
to
do,
and
I
had
to
kind
of
work
around
their
policies.
So
I
understand
how
much
of
a
drag
it
can
be
and
we'll
try
to
minimize
it
as
much
as
possible.
A
I'm
going
to
be
eagerly
awaiting
to
see
the
the
recommendations
for
the
strategic
happiness
core
unit.
That's
for
sure,
going
on
the
theme
of
personnel
joshua.
You
may
be
better
suited
to
answer
this
too,
but
trevon
you
mentioned
that
your
time
will
be
limited
so
between
munify
and
maker
dow,
and
I
know
that
there's
a
lot
of
tasks
out
just
to
run
the
core
unit
from
a
philistine
facilitator
perspective.
B
From
I
said
I'll,
let
joshua
answer
as
well
later
on,
but
so
far
I
I
think
that
both
of
us
will
be
able
to
handle
it.
I
want
to
also
emphasize
we
emphasize
the
immunify
service
security
services
aspect,
so
you
know
I'm
gonna
get
my
colleagues
to
help
out
with
this
as
well.
Yes,
it'll
be
through
immunify,
but
we
do
have
much
more
help.
I
know
that
you
know
in
terms
of
the
team
is
joshua
and
I
but
there's
much
more
people
behind
this
yeah
I
mean
with
the
content
itself.
B
C
A
A
The
questions
are
still
open.
It
seems
like
the
the
chat
is
a
little
bit
quieter.
The
last
question
that
I
would
have
for
the
group
to
end
on
if
no
others
come
up,
would
be
your
philosophy
on
proactiveness
and
reactiveness,
especially
when
it
comes
to
something
with
security.
Do
you
guys
have
a
defined
framework
that
munify
follows
to
try
to
prioritize
some
of
these
tasks
being
either
reactive
or
proactive,
or
is
it
more
of
a
case
by
case
protocol
by
protocol
approach
for
developing
that
framework.
B
A
lot
of
it
is
very
case
by
case
I
have
to
say:
minker
dao
is
one
of
the
more
decentral
actual
decentralized
protocols
that
I've
seen.
So
it's
a
very
different
approach
compared
to
other
descendants
organizations
and,
of
course,
even
much
more
than
centralized
organizations
where
you
know,
there's
somebody
that
I
could
call
like
if
it's
a
website
there's
somebody
out
there
who
can
shut
down
the
website.
If
something
is
coming
going
on,
it's
very
different
here,
so
a
lot
of
things
are
going
to
be
custom
built.
B
You
know
a
lot
of
the
procedures.
We
probably
wouldn't
be
able
to
use
ever
anywhere
else,
and
that's
fine,
but
that's
why
again,
also
that
we
have
to
make
our
own
security
core
unit
here,
because
we
have
to
really
understand
how
the
ecosystem
works
in
order
to
be
able
to
deliver
a
good
service
to
the
ecosystem
so
yeah,
our
philosophy
is
this
is
unique
and
we're
going
to
have
to
take
it
very
uniquely.
I
know
also
each
core
unit
is
going
to
be
different
and
it's
it's.
B
For
mine,
I'm
on
discord
on
the
ses
discord,
like
I
said,
we'll,
be
opening
up
the
minify
security
core
unit
discord
channel
as
well
on
the
unified
discord.
So
I
added
the
invite
to
the
last
slide
of
my
presentation
there,
but
on
the
forum
you
can
also
reach
out
to
me
by
sending
a
direct
message.
I'm
also
have
my
contact
information
on
telegram
there
on
the
facilitator
on
morning
map.
So
I
can
reach
out
there
too
perfect
joshua.
A
Fantastic
we'll
make
sure
to
update
the
the
forum
post
for
the
core
unit
launch
part
call
with
the
recording
as
well
as
well
relevant
links
to
get
a
hold
of
you
guys
and
very
excited
to
see
the
outcome
of
the
the
formal
submission
just
trending
in
the
right
direction
and
very
excited
to
see
the
work
that
you
guys
produce.
So
thank
you.
Everyone
for
joining
the
call,
trevin
and
joshua,
especially
and
hope
everyone
has
a
great
rest
of
their
day.