,
7 tweets,
3 min read
Read on Twitter
Kostya's keynote: LibFuzzer hasn't found new bugs in <big software companie>'s library. We didn't know why. Later we got a note that they are now using LibFuzzer during regression testing in CI and that it prevented 3 vulns from reaching to production. 
In Chrome, libFuzzer found 4k bugs and 800 vulns. In OSS-Fuzz, libFuzzer found 2.4k bugs (AFL found 500 bugs) over the last three years.
@kayseesee #fuzzing #shonan
@kayseesee #fuzzing #shonan
@kayseesee Fuzz-driven Development: Write your fuzz targets first.
@kayseesee "We need proper approaches to benchmark fuzzers. Retire LAVA & CGC. Use real bugs, e.g. github.com/google/fuzzer-…"
@kayseesee Correction: We need even better ways of benchmarking, e.g continuous A/B benchmarking as a side effect of continuous fuzzing
@kayseesee Excellent conclusion!
Even better! @kayseesee just told me that they just needed to link to a stub that executes the produced seeds and use them as regression tests during CI.
