#DappCon22 : Day 2 - The Evolution Of Offensive Security - Better Incentives For Hackers, Gonçalo Sá

Transcript

okay so for the last talk this morning before lunch we have gonzaleza from diligence and he's gonna hug you for free and talk about the evolution of offensive security building better incentives for hackers thank you I don't know about free but I'll hug you this works okay oh hey great hi guys um my name is Gonzalo for those of you that know me hi for those of you that don't I'm one of the co-founders of the consensus diligence team we've been doing security for the past six years almost now doing security meaning that we've been doing got it for web3 both on

and off chain code uh so we know a little bit about Security in the web 3 space but today I come to you with a very heavy heart um and sad news um the news is that security is really hard and it's not solved yet um I was talking to Arjun yesterday about like preparing the talk and uh and I realized that like I really didn't need to prepare for this because like all of the things that I'm going to talk about today are things that we've felt for the past six years they're problems that we have you might see some oversimplifications and some

generalizations that you may disagree with but this is how we feel like this is how we feel right now this is how we feel intelligence this is what has gone by that we couldn't solve throughout the entirety of these six years um the first thing is that security Talent is hard you know like the the learning curve to to become an auditor and a good a good and important distinction that I should make uh early on is that the title of the talk is building better incentives for hackers the problems that I'm talking about today they're not specifically about a hackers they're about Auditors an

Auditor's job is entirely different from a hacker's job you know like on one side you're actually trying to protect um if if your Audi if the the code was a ship you're literally for doing it from inside the ship trying to cover every little hole that's an Auditor's job but if you're an attacker if you're a hacker all you need to do is find one hole from the outside so so the the the job is entirely different and the problems that that were that I'm going to allude to are mostly Auditors problems and not specifically hackers problems the reason why I make the decision will hopefully become clear as I talk but uh

we are solving the problems of Auditors more so than than the problems of like bug bountyors and whatnot the idea is that they'll come together hopefully it'll make sense at the end but yeah security Talent is hard uh the learning curve is steep uh the Italian retention and again this this pertains to security audit firms and and we I shouldn't be using the audit term because we at SVC we all agreed that it should be Security reviews but it's just for uh because it's a more familiar term retention for security audit firms is really hard mostly because of the other tools in the in the security landscape like go to rename unify people uh hackers have a tendency to work really well alone and

so they they go to these things um they can work whenever they want uh they they get lumps of money but but also they take their own vacations they do their things the way they want it and um and again like it's hard but working with the team is also cool and doing the auditing job is also cool it's it's not only cool to find crits on immunify it's also good to work in a team uh also and this is more from like a user's perspective or a client's perspective like availability is really hard to come by I'm not saying that we're gonna solve the capacity the problem of security firm's capacity we're not but I think that we can do one thing well or better uh which is the

prioritization of said work like the way we prioritize who gets a nodded and who doesn't or at least who gets an audit first can be optimized um the third point is that there's weak alignment again um there's different models people work in different ways we have had retainers over the years we've worked in different ways with our clients but generally speaking again over generalization You can disagree with me we can talk outside but there's weak alignment between the Auditors and the projects that they audit you know like look like long-term alignment is simply not there and the third point that I make here is that that makes it

so that the tools post audit to secure your product is only bug bodies but but again remember that these platforms are plagued by Static analyzers and people that are only one spare advice you know one set of eyes it's they are alone looking at your code and there's to be honest I don't think there's anything better than a better review session when thinking about the security of your project so you're not getting the full experience we can do better we can get Auditors to also care about your product post deployment post launch post audit in apologies for the mistake over there this is like carried over from

Portuguese I just found out that the inexistent word doesn't exist It should read non-existent um but the last Point here is that public goods funding is also non-existent uh I I that's a stretch the first sentence people will probably get mad at me because of this I I actually corrected this in the final version of the slides this is this is the draft but saying that most of the security and Dev tooling is being built as a public by security firms is definitely a stretch what I meant is like the security Dev tooling uh because there's there's a clear there's a clear separation in that you know uh like we are building the extensions and the visualizations that

Aid us in our job but mostly we do it for the reputation which is a very very indirect way to derive value you know like we we are building it for ourselves but also for the community um and again like it's just like it's a very indirect way for us to capture value and again like this might be an over generalization the second point that I make there but also we are delicious like we try to maintain an agnostic position um over the things that we added over the over the the projects that we choose and the platforms that we choose and that makes it so that we again like we don't fully capture the value of building these tools for sad communities because the allegiance is not long eat diligence is not long anything

diligence is purposefully agnostic you know to to avoid conflicts of interest and whatnot and that's hard when you're just like putting out tools for free welcome creep uh we're not going to solve everything uh maybe we won't solve anything at all but at least you're gonna try um green is hopefully going to be amazing first it has really good graphism so it's like a mix of Dune and Assassin's Creed and like hoodies and hooded characters and and [ __ ] um so it's cool that's the first thing um but also Creed is a community of

hackers so and this is going towards the first point of telling what we want to do is actually get people to audit stuff as opposed to finding crits in bug bunnies we want to get all the lone wolves to work together with the Auditors and so like we're going to make it a collective it's a security Collective if you will we want to bring all the hackers talented again like not only Auditors but the lone wolves everybody we we want to provide like Fair terms for their work you know we want to we want to make sure that everybody has the upside that they deserve and that they're accustomed to when they do bug

Bounties in in in the other platforms or or whether they're doing auditing work also like it should be a community of vetted people so Creed will try to maintain a certain quality of output this greed I won't be going too much into the details of the implementation of Crete today this is merely an unveil of of what's to come and so I'm happy to discuss the the the details offline and and most of our team is going to be here you can catch us outside and we can discuss this at length um but the idea is that Creed will be a gated community to begin with you know

repetition is hard to to do we're not trying to solve reputation but there will need to be a repetition system involved in this and like it will be a gated community but it will be a community of vetted people it will hang out with good hackers with people that actually care about that you'll be hanging around people that have Alpha you that's the idea that's the premise um and obviously we're going to try and do better long-term incentives [Music] um which brings me to to this next slide which is like it's also good for product teams right um again like the the fact that it is a gated community or a vetted community of professionals will will guarantee a

quality of output this is not new this is not new to you the the fact that you go to certain security firms also uh already guarantees you a certain quality of output so this is not new we're just doing the same thing but bringing in the lone wolves right um also we want to make sure that Creed has the right incentives long term and so like we create will encourage every protocol every client everyone that comes to Creed for for work to do token exchanges and to like to to fund the treasury um with their own asset so that we get

alignment long term and people keep looking at your code even after or not it is done um and obviously we would also like for projects and product teams to be a great participant uh again not going too much into details but the idea is that like the community itself uh will decide on priorities and what to build and what not which which brings it to the to the last point which is like Creed needs to be accounted for better public goods um so funds accumulated uh through Creed will be used for sponsorship of security and devtooling solely

it this means that the create Community will decide on what gets built on who gets the money and there will be money this this will be the assets will be transferred you don't need to build only for reputation anymore let's stop that like you should get you should get the the the the the the the the resources that uh that you need to build these things ahead of time and not after right um also the Creek community will hopefully serve as a strong signaling um product as to what needs to be built so even before we decide on who gets

money to build what we hope that the great Community great holders will actually signal very clearly on what tools need to be built what do we need now do we need a mutation testing integration with Foundry what you know all of these small things we hope that the communities like actually rallies behind it and gets us the good off on what public goods are needed and whatnot uh in I'm going to close out about like why should you care I hope that at this point it's it's already apparent uh but if we can go through it again uh so if you're a hacker uh you basically get a long-term upside you know like if you

audit something so basically we're we're making this the security the security auditing space look more like VCS right which is a model that has actually been working with other people where they call themselves VCS but the only thing that they do is actually they care about the security of your product and they'll they'll take Equity or tokens or whatnot so you as a hacker you get exposed to this deal I really don't like this because like the the vision in my head is way more romantic than the the type of language that I'm using right now but it's true uh this is behaving more like VCS and so you get bigger upside also if we bring in all these like lone wolves all these hackers that are only

participating in bug bounties you'll have a family and this is also good like this can be understated but I also think that like having a family is pretty pretty [ __ ] great you know like you don't need to be alone all the time in your basement you can hang out with friends um and uh and we're pretty cool people so you know like it's a it's a it's a good family uh also also the fact that that Creed will be structured uh and and will need to have we've thought very very long about this but there will need to be an asset that represents a staking Creed uh and this means that you also share the upside on other people's works uh on other people's work which is really good again like uh family and obviously like

if you're if you're a great participant hopefully Creed becomes important enough that being being a a participant in the Creed community means that you're actually shaping web3 so if we decide what tools get built or like if we signal what tools should be built hopefully uh that is that is another point with which you you want to be part of it oh and wait did I break it and you get cool swag I almost forgot we have all the plans to make the best swag okay like uh if you're tired if you're as tired as me of you know shitty t-shirts you're you're in like you're you're a good friend will make the best

swag uh and if you're a project Dev uh again like long term the line Midwood Auditors uh you also get a better prioritization system out of the out of the Crete community and the Crete signals uh so if you want to beep as a project Dev if you also want to be part of the Creed family you also get to prioritize yourself or or your friends right um and if you go to Creed to to get security work done you're actually giving back to the community how like how how is this not a great thing so like should I go here and give 100 of these people or should I go here and

give 10 15 20 back to the community you know like you know that you're funding the work that you will use later on you know like are you using the vs code extension the solidity visual accession well then come to Creed and you're paying for it in an indirect way but you are essentially paying for your own tools you know for the tools that you'll use later on and again really really cool collab swag which we really want to do go like full a24 on this thing and every time like this this would be marvelous and it is our plan every time Creed the security work for some project we'll do collab swag and

we'll put it in the shop but it's gonna be great it's gonna be great um it's 2022. we're we're gonna launch it this is gonna happen um maybe it doesn't solve anything hopefully it solves a lot of these things we're we're working really really [ __ ] hard that it so that it does solve these things but at the very very least we're gonna try that's what I can promise thank you so much go visit the website it's decree.xyz it's it was installed until now there's a mailing list will tell you when we're ready it's going to be soon so soon thank you so much guys

questions I have for this great teaser um does someone have a question or are you just waiting to sign up when is that going to be possible so yeah so the the mailing list is already up we'll give you news so if you if you subscribe on on the website right now we'll send you an email out with news hopefully it's months out one two tops so go there subscribe you want another free hug yeah I was just wondering um like you're talking about getting a bunch of these like Lone Wolf hacker

type people together and I was just wondering why haven't they joined security auditing firms already and what about Creed makes it so much more attractive for them to not do what they're Contin that they're currently doing yeah so I I think and again this might be an over generalization but the reason why they they haven't is because they really enjoy doing the work in their own time and it I said like I put it in one of the slides these people like to have a six month vacation work for a month find a great and go away so Creed will enable that create again like Creed will be a system where like and and this is this is complete this is

made in parallel to all the diligence activities I want to make this very clear so like all all even companies or single people can be participants in Creed and they'll come together they'll work on a project that they've signaled interest for for that for the duration of the project and then they can go away you know we won't revoke your access you don't need to work continuously to prove that you're we're calling these people paladins by the way uh I said I'm going to reveal too much I can talk about these things in more detail outside and we'll take it offline um we're calling them the paladins and we want revoke access once you're a paladin you're a palette um and you can just like come and go work as you please and hopefully that'll be since they also share aside from the

work of all the other people and they'll get a say you know like in what gets built and whatnot hopefully this is interesting enough for them to just like join why wouldn't you you know like it's non-committal so no oh there's another one uh usually Auditors they have teams and collaboration and specialization inside and they can spread the efforts of the auditing inside uh here I can see the model the different people work with different people so what about Effectiveness this is one

and how you're going to deal with the failure so can you repeat the first question yeah I mean different people yeah work with different people and this is not the one team that's usually Auditors do and they make that it makes them much more productive because they know how to work together different capitalization and here I see the situation different people that really don't know one each other okay so you're saying that uh where is in a security audit firm let me see if I understood the the question correctly whereas in the united firm people are accustomed to each other and they're attuned and they know how to work together in a group here since like there's a different collection of people

uh they might not work as well together and so it might just so be that it ends up being a little bit code arena-ish is that the question I I may reporting because like it just means that they work like kind of like in parallel and they don't really work well together so um again I can't be sure that that won't happen but I think that falls under the under the the thing that I said we wouldn't solve for sure which is the reputation system um Creed will need to have a guarantee of quality for sure and again like this thing will need to be gatekeeped and it won't be permissionless in that sense uh we can Implement later on in a V2 or

something a repetition system based on like attestations from people that are already there and so they they'll choose their co-workers and people that they want to they want that that can join the family but uh in the beginning it'll honestly have to be chosen cherry-picked people are cherry-picked by by us to to join the family and hopefully we'll we'll be careful enough when choosing these people that we know that at least in a in an early stage in in a in a in an early stage early on like these people know how to work together so we'll need to guarantee that in the beginning how it'll work when we really want to make it permissionless I'm not entirely sure

well thank you again and so um we're gonna break for lunch and we'll meet everybody back at 1 30. [Applause]