This is a program that I've been championing within @nivenly over the past year, after we noticed that security vulnerabilities weren't being disclosed responsibly, and not enough research was going into the security of Fediverse software.
ActivityPub Test Kategorie
21
Beiträge
10
Kommentatoren
295
Aufrufe
-
We also know that GitHub Sponsors isn't super ideal for payments, but it's a way for us to test the program and ensure compliance with KYC/AML and various other legal requirements.
Hopefully in the future we'll be able to offer more ways to pay the bounties out, if the program continues.
schrieb am 2. Apr. 2025, 15:33 zuletzt editiert vonaaand aaah, TechCrunch have covered the announcement! Thanks @Sarahp!
A new security fund opens up to help protect the fediverse | TechCrunch
A new security fund aims to help apps in the fediverse — like Mastodon, Threads, and Pixelfed — to pay researchers for disclosing security bugs.
TechCrunch (techcrunch.com)
-
This is a program that I've been championing within @nivenly over the past year, after we noticed that security vulnerabilities weren't being disclosed responsibly, and not enough research was going into the security of Fediverse software.
You might remember my Pixelfed vulnerability from last year, where OAuth scopes weren't checked allowing for privilege escalation via the API (CVE-2024-25108), that was our very first test-case of this program.
I'm incredibly proud to be involved in launching the Fediverse Security Fund from Nivenly Foundation (a 501(c)4 not-for-profit cooperative)
schrieb am 2. Apr. 2025, 16:57 zuletzt editiert von@thisismissem @nivenly this is such a cool and needed project!
-
This is a program that I've been championing within @nivenly over the past year, after we noticed that security vulnerabilities weren't being disclosed responsibly, and not enough research was going into the security of Fediverse software.
You might remember my Pixelfed vulnerability from last year, where OAuth scopes weren't checked allowing for privilege escalation via the API (CVE-2024-25108), that was our very first test-case of this program.
I'm incredibly proud to be involved in launching the Fediverse Security Fund from Nivenly Foundation (a 501(c)4 not-for-profit cooperative)
schrieb am 2. Apr. 2025, 16:58 zuletzt editiert von@thisismissem @nivenly This is awesome - congrats and so excited that you're a part of this!
-
@thisismissem @nivenly This is awesome - congrats and so excited that you're a part of this!
schrieb am 2. Apr. 2025, 17:02 zuletzt editiert von@quillmatiq @nivenly it's something I'm really proud of, and hopefully it can help do some good.
-
aaand aaah, TechCrunch have covered the announcement! Thanks @Sarahp!
A new security fund opens up to help protect the fediverse | TechCrunch
A new security fund aims to help apps in the fediverse — like Mastodon, Threads, and Pixelfed — to pay researchers for disclosing security bugs.
TechCrunch (techcrunch.com)
schrieb am 2. Apr. 2025, 17:03 zuletzt editiert vonA great project! Thanks @Sarahp for covering it!
-
This is a program that I've been championing within @nivenly over the past year, after we noticed that security vulnerabilities weren't being disclosed responsibly, and not enough research was going into the security of Fediverse software.
You might remember my Pixelfed vulnerability from last year, where OAuth scopes weren't checked allowing for privilege escalation via the API (CVE-2024-25108), that was our very first test-case of this program.
I'm incredibly proud to be involved in launching the Fediverse Security Fund from Nivenly Foundation (a 501(c)4 not-for-profit cooperative)
schrieb am 2. Apr. 2025, 17:06 zuletzt editiert von@thisismissem @nivenly This is amazing. Congratulations, and good work!
-
@thisismissem @nivenly This is amazing. Congratulations, and good work!
schrieb am 2. Apr. 2025, 17:08 zuletzt editiert von -
aaand aaah, TechCrunch have covered the announcement! Thanks @Sarahp!
A new security fund opens up to help protect the fediverse | TechCrunch
A new security fund aims to help apps in the fediverse — like Mastodon, Threads, and Pixelfed — to pay researchers for disclosing security bugs.
TechCrunch (techcrunch.com)
schrieb am 2. Apr. 2025, 17:09 zuletzt editiert von@thisismissem @Sarahp This is awesome!
-
This is a program that I've been championing within @nivenly over the past year, after we noticed that security vulnerabilities weren't being disclosed responsibly, and not enough research was going into the security of Fediverse software.
You might remember my Pixelfed vulnerability from last year, where OAuth scopes weren't checked allowing for privilege escalation via the API (CVE-2024-25108), that was our very first test-case of this program.
I'm incredibly proud to be involved in launching the Fediverse Security Fund from Nivenly Foundation (a 501(c)4 not-for-profit cooperative)
schrieb am 2. Apr. 2025, 18:09 zuletzt editiert von julian@community.nodebb.org 4. Feb. 2025, 20:12@thisismissem@hachyderm.io what would buy-in from fediverse software look like?
NodeBB has its own bug bounty program that awards reporters directly, but if the FSF were to shoulder the grunt work of reporting (and act as a liaison between us and the reporter), we'd be happy to discuss covering the reward and associated costs, for reports that come from Nivenly directly.
-
schrieb am 2. Apr. 2025, 18:23 zuletzt editiert von
@julian you're still receiving the vulnerability reports directly with the Fediverse Security Fund; we pay *after* you've confirmed & patched.
I wasn't aware of your bug bounty program, but could list that alongside your project.
-
@julian you're still receiving the vulnerability reports directly with the Fediverse Security Fund; we pay *after* you've confirmed & patched.
I wasn't aware of your bug bounty program, but could list that alongside your project.
schrieb am 2. Apr. 2025, 18:40 zuletzt editiert von julian@community.nodebb.org 4. Feb. 2025, 20:41@thisismissem@hachyderm.io great. I'm thinking that for reports coming from Fediverse Security Fund directly, we'd cover the reward portion (the High (7.0 - 8.9) – $250 USD, Critical (9.0+) – $500 USD) part, either directly to the reporter or more likely through an in-kind donation back to the fund.
Also the fund may need a better acronym... FSF
-
@thisismissem@hachyderm.io great. I'm thinking that for reports coming from Fediverse Security Fund directly, we'd cover the reward portion (the High (7.0 - 8.9) – $250 USD, Critical (9.0+) – $500 USD) part, either directly to the reporter or more likely through an in-kind donation back to the fund.
Also the fund may need a better acronym... FSF
schrieb am 2. Apr. 2025, 18:59 zuletzt editiert von@julian so the reports don't come from Nivenly, the reports come from researchers and contributors and go directly to you. Once you accept & fix, and publish the advisory, the researcher/contributor can come to us and we'll pay them for their responsible disclosure.
They could also still collect from your bounty program as well, so rather than them getting just $256 or $512 from your program, they could get $506 or $1012 in total, because they can claim both bounties (if your program allows it)
(I mean, it's better than Fediverse Security Bounty — FSB
) -
@julian so the reports don't come from Nivenly, the reports come from researchers and contributors and go directly to you. Once you accept & fix, and publish the advisory, the researcher/contributor can come to us and we'll pay them for their responsible disclosure.
They could also still collect from your bounty program as well, so rather than them getting just $256 or $512 from your program, they could get $506 or $1012 in total, because they can claim both bounties (if your program allows it)
(I mean, it's better than Fediverse Security Bounty — FSB
)schrieb am 2. Apr. 2025, 20:49 zuletzt editiert von@thisismissem@hachyderm.io ah understood. I didn't quite get how the fund worked, but it makes more sense now (and is much simpler—organizationally—for Nivenly!)
I don't think we'll add exclusions for security fund recipients
I would say, though, that one of the requirements has to be that the affected software accepts the vulnerability. Plenty of self-proclaimed "security researchers" have filed reports, and some go as far as to publish CVEs (against our own software!) without our permission.
Quite the opposite of responsible disclosure.
