Welcome to proposals Discussions! #1
Replies: 4 comments 17 replies
-
|
Given the heavy dependence on LSRs, I propose that the recommendations for SRs to be promoted be raised to 0 - 5. I'm also not quite sure we defined times between promotions to certain positions. |
Beta Was this translation helpful? Give feedback.
-
|
The way I'm thinking it works is that each LSR gets to pick 0-2 candidates, and the recommendations are merged into a list with the number of votes for each candidate. For example, 5 LSRs could collectively recommend up to 10 unique SRs for promotion in a given cycle. |
Beta Was this translation helpful? Give feedback.
-
|
Acknowledged @0xsomnus - per @jakelang 's response the consolidated list of recommendations for promotion would be from a nominations given by LSR's and SR's on the roles. |
Beta Was this translation helpful? Give feedback.
-
|
Beta Was this translation helpful? Give feedback.
-
|
Re: your first point, the idea of limiting the number of promotions each cycle is to encourage members of the promotion committee to have to choose from the best possible candidates for SR->LSR promotion. The batch size is something the community should definitely decide ultimately, but I believe that promoting someone to LSR should be a very deliberate decision from those involved. Re: the next two points, this is entirely up for discussion :) I agree with apprentice cycle potentially being shorter. |
Beta Was this translation helpful? Give feedback.
-
|
There is an economic incentive to vote for oneself @0xbok . An apprentice without sufficient experience could also ask others to vote for him/her behind the scenes to get promoted as SR. I think it should be good to define first what are the skill differences between each group and how these can be measured. |
Beta Was this translation helpful? Give feedback.
-
|
Self-nomination is no different than asking others to nominate somebody as you’ve mentioned. Each promotion has economic incentive. It does not matter whether somebody nominated a person or a person feels he/she is ready to be promoted and wants to kick-off the review process. What matters is whether somebody is promoted or not and it’s the decision making process’ role not the nomination itself. I do agree then, that without a list of skills it is hard to decide on anything as without such a list only objective stuff like rank in Code4rena (days/rank to be decided) or paid high bug bounties matter. That skills list is actually also important to justify why some promotion was accepted or why some was declined. After all I would expect from a declined promotion a clear info what to do better for the next time. |
Beta Was this translation helpful? Give feedback.
-
|
+1 to what @grmpyninja said. Incentives are same in both ways (self-nomination vs somebody else nominating). To define a quality threshold, we can look into how other audit companies select their candidates. Perhaps, Spearbit auditors who worked at these companies can contribute here. As to protecting the promotion process from that incentive, I can think of a few things (some of them may be wrong) -
The governance here can be as simple as Discord votes or private voting/veto among LSRs or Spearbit Core team. |
Beta Was this translation helpful? Give feedback.
-
|
Acknowledged @grmpyninja and @0xbok - I really like the idea of having the promotions go through governance. Please see the shortlist of skills for each role that are listed in the current proposal - we want to keep this short but any recommendations on key skills that should be added? |
Beta Was this translation helpful? Give feedback.
-
|
It's a bit unclear to me, as an apprentice what it is that I can work on in order to be eligible for a promotion.
|
Beta Was this translation helpful? Give feedback.
-
|
Actually - we're often short-staffed on LSRs. The LSRs are the bottleneck, but the quality is the brand - this is the dilemma @0xsomnus |
Beta Was this translation helpful? Give feedback.
-
|
To respond to @naps62 - I think the best people to ask would be the LSRs you work with. The more an LSR gets comfortable working with an individual the more they are likely to trust the SR with leading. I actually disagree with the part of the proposal that suggests we should have the objective standards detailed in the LSR section - I think it's impossible to quantify this expertise. I think there are really only three things that matter here: (1) is a self nomination. Most auditing firms use their brand to justify their use of less experienced auditors. This is why this selection process should be discerning, holistic and at times, feel unfair. |
Beta Was this translation helpful? Give feedback.
-
|
For the promotion of Apprentice -> SR, maybe a periodical CTF or a single internal audit task/exercise designed by Spearbit core team + LSR's could add great value to the promotion process. The team knows the skill set required for the kind of gigs Spearbit takes up & designs an exercise accordingly. |
Beta Was this translation helpful? Give feedback.
-
|
I like this idea @hrishibhat - it would be great to get brainstorming on how this could actually look like and be implemented. |
Beta Was this translation helpful? Give feedback.
-
|
@moiseiggy anytime. Let me know how and when. |
Beta Was this translation helpful? Give feedback.
-
|
Honestly when I think about it, what do you think about a more skill-oriented flexible system, rather than some fixed (undefined completely for now) criteria for each position. For objective stuff like rank in Code4rena, disclosed and paid bug bounties or well-known proven stuff like top known IT sec specialists it’s quite easy how to assign ranks. For others, so the majority I guess, practical experience should be crucial, so skills + experience should count together. Also I’m kind of missing soft skills on the list for a consultant. Anyway, maybe a different approach, so badges-based system would be a good idea. e.g. I do some Spearbit gig and during that gig I write basic tests in foundry, fuzzing tests, I do reporting, I’m active in discussions, in comms with the customer etc. After the gig I get badges signed by LSR/SR: foundry-lvl-0 (basics), foundry-lvl-1(fuzzing), client-comms-lvl-0, reporting-lvl-0, sec-vuln-lvl-0 (gas optimisations), sec-vuln-lvl-1(A,B,C low-level), sec-vuln-lvl-2 (X,Y,Z-medium level vulns) Then periodically a selected group (or all with LSR/SR) decides which badges are necessary (how many distinct sources of badges) to kick off the promotion for somebody and if conditions are met and a person has those badges then gets promoted. Over time it is necessary to know and be good at more and more stuff, then new badges are added and thresholds are modified. Skills/badges can be in generic categories like:
etc. categories + levels depending whether something is advanced or not. Badges can be collected either from:
Depends of course on the implementation it can be very complex or it can be light at the beginning and gradually badges can be added and thresholds adjusted. |
Beta Was this translation helpful? Give feedback.
-
|
wow this is a really strong idea - have you heard of Otterspace? they do non-transferable tokens which serve as "badges". This might be a viable solution and implementation. @grmpyninja |
Beta Was this translation helpful? Give feedback.
-
👋 Spearbit Promotion Process Proposal
This proposal is to formalize the first iteration of the Spearbit Promotion Process as we push to a truly decentralized and self-governed community. The core team realizes the value that is presented by having the community outline the current roles and responsibilities amongst our Auditors. As well as begin to construct a transparent promotion process.
Security Researcher Role Descriptions
Lead Security Researcher (LSR)
Renowned experts in blockchain security who lead audit teams and mentor other security researchers.
Shortlist of Qualifications for this role: Core Developer at Tier 1 Protocol, Auditor at Tier 1 Firm, Top 10 on Code4rena, Experience finding and reporting critical and high vulnerabilities.
Security Researcher (SR)
Intermediate level blockchain security personnel who have some independent audits under their belt and continuously improve their skill set under the mentorship of LSRs.
Shortlist of Qualifications for this role: Junior Auditor position at Tier 1 Firm, Top 30 rank on Code4rena, Bug Hunting experience, Strong knowledge of Setup and Testing of Solidity projects.
Apprentice
Junior personnel who are just breaking into blockchain security. They participate in projects by focusing on report writing, running manual tests, and unblocking the efforts of other security researchers where possible.
Shortlist of Qualifications for this role: Passed technical assessment, Solved CTF’s (i.e. Ethernaut), Completion of Secureum RACES, Portfolio of Ethereum security related content.
Promotion Process
The core team has a proposed frequency and methodology for handling the promotion of Apprentice to Security Researcher and Security Researcher to Lead Security Researcher.
Apprentice to Security Researcher
Announcements of promotions will be communicated directly in the Spearbit Discord.
Security Researcher to Lead Security Researcher
Announcements of promotions will be communicated directly in the Spearbit Discord.
Beta Was this translation helpful? Give feedback.
All reactions