
thisismissem@hachyderm.io
Posts
-
This is a program that I've been championing within @nivenly over the past year, after we noticed that security vulnerabilities weren't being disclosed responsibly, and not enough research was going into the security of Fediverse software. -
This is a program that I've been championing within @nivenly over the past year, after we noticed that security vulnerabilities weren't being disclosed responsibly, and not enough research was going into the security of Fediverse software.@julian we'll see how the fund goes, but we can always change the terms as necessary to get the right output, that's why this is an experiment.
-
This is a program that I've been championing within @nivenly over the past year, after we noticed that security vulnerabilities weren't being disclosed responsibly, and not enough research was going into the security of Fediverse software.@julian yes, that's exactly what needs to happen. Like, it's CVE + the fix merged into the project. And we'll actually verify that before paying out. Definitely don't want those low quality reports for stuff that isn't actually a CVE
-
This is a program that I've been championing within @nivenly over the past year, after we noticed that security vulnerabilities weren't being disclosed responsibly, and not enough research was going into the security of Fediverse software.@julian so the reports don't come from Nivenly, the reports come from researchers and contributors and go directly to you. Once you accept & fix, and publish the advisory, the researcher/contributor can come to us and we'll pay them for their responsible disclosure.
They could also still collect from your bounty program as well, so rather than them getting just $256 or $512 from your program, they could get $506 or $1012 in total, because they can claim both bounties (if your program allows it)
(I mean, it's better than Fediverse Security Bounty — FSB
)
-
This is a program that I've been championing within @nivenly over the past year, after we noticed that security vulnerabilities weren't being disclosed responsibly, and not enough research was going into the security of Fediverse software.@julian you're still receiving the vulnerability reports directly with the Fediverse Security Fund; we pay *after* you've confirmed & patched.
I wasn't aware of your bug bounty program, but could list that alongside your project.
-
This is a program that I've been championing within @nivenly over the past year, after we noticed that security vulnerabilities weren't being disclosed responsibly, and not enough research was going into the security of Fediverse software. -
This is a program that I've been championing within @nivenly over the past year, after we noticed that security vulnerabilities weren't being disclosed responsibly, and not enough research was going into the security of Fediverse software.@quillmatiq @nivenly it's something I'm really proud of, and hopefully it can help do some good.
-
This is a program that I've been championing within @nivenly over the past year, after we noticed that security vulnerabilities weren't being disclosed responsibly, and not enough research was going into the security of Fediverse software.aaand aaah, TechCrunch have covered the announcement! Thanks @Sarahp!
https://techcrunch.com/2025/04/02/a-new-security-fund-opens-up-to-help-protect-the-fediverse/
-
This is a program that I've been championing within @nivenly over the past year, after we noticed that security vulnerabilities weren't being disclosed responsibly, and not enough research was going into the security of Fediverse software.@Sbectol oh, good catch! My brains' off in the clouds today, I swear
-
This is a program that I've been championing within @nivenly over the past year, after we noticed that security vulnerabilities weren't being disclosed responsibly, and not enough research was going into the security of Fediverse software.We also know that GitHub Sponsors isn't super ideal for payments, but it's a way for us to test the program and ensure compliance with KYC/AML and various other legal requirements.
Hopefully in the future we'll be able to offer more ways to pay the bounties out, if the program continues.
-
This is a program that I've been championing within @nivenly over the past year, after we noticed that security vulnerabilities weren't being disclosed responsibly, and not enough research was going into the security of Fediverse software.One of the interesting clauses on the program is that we expect researchers and contributors to follow the Nivenly Covenant when reporting security vulnerabilities to be eligible for the program.
We want to encourage positive contributions, after we've seen several announcements of security vulnerabilities where the reporter treated the project with disregard or insulted the team behind it. That isn't cool.
We can together all make a safer fediverse.
-
This is a program that I've been championing within @nivenly over the past year, after we noticed that security vulnerabilities weren't being disclosed responsibly, and not enough research was going into the security of Fediverse software.@janl told y'all I was announcing something this week that I'm incredibly proud of!
-
This is a program that I've been championing within @nivenly over the past year, after we noticed that security vulnerabilities weren't being disclosed responsibly, and not enough research was going into the security of Fediverse software.This is a program that I've been championing within @nivenly over the past year, after we noticed that security vulnerabilities weren't being disclosed responsibly, and not enough research was going into the security of Fediverse software.
You might remember my Pixelfed vulnerability from last year, where OAuth scopes weren't checked allowing for privilege escalation via the API (CVE-2024-25108), that was our very first test-case of this program.
I'm incredibly proud to be involved in launching the Fediverse Security Fund from Nivenly Foundation (a 501(c)4 not-for-profit cooperative)
-
We're organizing a NGI Zero network meetup at #FOSDEM. -
Question re: PeerTube's pubkey IDs@julian iirc, that hash fragment part isn't exactly spec behavior?
-
User-Agent header for AP requests@julian @hongminhee@todon.eu @hongminhee@fosstodon.org yeah, it helps with federation for instances sitting behind like Cloudflare and similar.
-
Question re: @context and JSON-LD@julian depends on if your property conflicts with any other defined properties. (see the schema.org problem)
-
Quoted posts@julian so perhaps more an advocacy thing than a feature change?
-
Quoted posts -
Quoted posts@julian @leroy I think <blockquote> is fine, so long as it's attributes link to the post it's quoting from? That way in Tags you could have a Quote Tag or something that's just a Link to the quoted post.
Obviously you'd probably want to align with @renchap and the Mastodon team on the difference between Quote Posts and Quotes within Posts — does it make sense on a forum to prohibit quoting of you?