Related ... Bitcoin Foundation thread:
 - http://bt.irlbtc.com/view/49841.0

I've been procrastinating creating a "Bitcoin Testing Project" to fund testing work, and I was actually thinking a few days ago that vulnerability bounties would fit in nicely as one of the things a Bitcoin Testing organization would tackle.

I decided to stop procrastinating today; see my announcement here for a Bitcoin Testing Project:
   https://bt.irlbtc.com/view/80019.0

This is a nice idea,

but as someone that participates in real world software bounties (from office, to firefox, to qnx and cashmachines) i can see a couple of initial issues,

I am not sure how this would work, you would need to hire people are retain them even if they are not doing productive work.  an exploit for bitcoin would be worth far more than any dev bounty. 

So you will only get bugs that people report because they love the project.  dont get me wrong i am not against the idea, i just think it probably wont attract the kind of people and talent that you are expecting.

a new unpatched remote bug in the client, or in spending someone elses coins bug in a _production_ version of bitcoin would be worth well into the $500k range, probably more. 

Maybe bounties for security bugs in the latest test branch... it would be workable and make sense.

I am in two minds about paying for bug types 3 and 4 i think the system will be swamped with type 3 that are not really type 3 or cant be fixed, or wont be fixed, i am nor sure.  the catagories are so broad.

i will keep thinking about this, it is an interesting topic.

It's not clear that it's TYPE 1.  We think it might have that risk but the nature of it is so hard to characterize that we don't know for sure.   This is one issue for bounties— it may change the incentive for how bugs are reported to users.

If there is a memory corruption bug that I can't prove that it's not remotely triggerable or can't overwrite something important, I'm inclined to call those remotely exploitable— because I can't show that they aren't and it's better that users treat at as potentially too serious than not serious enough.  But if thats tied to paying someone the incentives aren't quite the same.


Which bug are you talking about here?

Check the article http://erratasec.blogspot.com.ar/2012/05/15-years-ago-when-we-started-industry.html about the cgi-php vulnerability and why open source does not mean better security unless there is a incentive for white hat hackers to look at the code.
 

I guess most Bitcoin developers do care about Bitcoin a lot AND also about money. They probably work part time in other things.
If we don´t offer bounties, we still may be able to find vulnerabilities, but maybe not before the attackers.
We need to be one step ahead.

Why only may? we will be able to find vulns.

I still dont see how offering a bounty will help.  if we offer $10k per vuln and zdi will give you $50k will report it to bitcoin for free then that is the path that makes the most money. i do not think we will ever be able to compete with the likes of the zdi, their business model is completely different and vulns are worth _a lot_ more to them and thier customers. I do not think we can be competitive with big bugs anymore, bitcoin is worth too much.

I still think paying people for work and reports is a decent alternative which still rewards the community. and can be integrated with normal testing.

Earlier you mentioned that the price to be paid would be set by the community.  This is asking for trouble.  What does the general populace know about competitively pricing vuln bids?

one last point, you also implied that it would be trivial to verify.  I can attest that it is never simple.  I have worked for the REACT team at microsoft (the people that verify vulns submitted by the public) it takes at least a week and a lot of back and forth (and that is for the reproducible ones).  This would be a nightmare for people reporting their $10k dos.

I understand and agree that it is very important to incentivise and reward the testers (both sec and non sec) however I do not feel bounties are the right way for bitcoin at the moment (the business model only really works for people that sell something and need zero days to fund IPS2.0(r) ).  there is a lot more work involved with it than i think you realise.

The more I think about it, the more I think it should work something like this:
1 - you go to the security test section of https://secure.bettermeans.com/boards/4240
2 - find the section that you fancy having a look at, in this case it is network (for arguments sake lets say https://github.com/bitcoin/bitcoin/blob/master/src/net.cpp)
3 - you then think you will see how the ipv6 stuff was played with when it was merged
4 - when you drill down to net.cpp testcases there will be a number of security ones, ranging from things like check source for off by ones to check source for double frees, check for races or something more free form like design new testcases for attack vector, investigate attack vector xyz, general review of source.
5 - then their will be a difficulty rating and a suggested reward for completion of the testcase

This is so much more useful, we get recorded coverage, the same tests will be looked at by many people, people are encouraged (by being rewarded) to share testcases, it still allows people to do free form testing and get rewarded (as long as their is a report and the testcases are annotated)

The software on betterminds seems to support this out of the box.  It is now just working out how all this should hang together to make it usable and consistent.

This is still a few weeks off yet though.

Watch the vid when you click on dashboard, it is well worth it.

Thanks for starting this thread, it is a very good point.

cheers,

steve

Steve, you seem to know better the security vuln research/advisory job than me. If you say that ZDI (*) will always pay more than Bitcoin, then we must encourage white hat hackers to either become testers or go through ZDI (if they want to).
As I never submitted  to ZDI, I don't know how much they value the vulns. But I will contact them and ask them how much would they pay for a vuln in Bitcoin (I don't know if that's possible without a real vuln)

Still (and this is my last thought) offering bounties transmits the message to the public that Bitcoin is in a position of strength.

(*) ZDI is the acronym of www.zerodayinitiative.com

PS: "Audit" was picked erroneously (English is not my native language)