3 ms·

I'd recommend to watch this: https://www.youtube.com/watch?v=y0hyqzR6hIY https://www.youtube.com/watch?v=y0hyqzR6hIY He goes into detail about how these types

I'd recommend to watch this: https://www.youtube.com/watch?v=y0hyqzR6hIY https://www.youtube.com/watch?v=y0hyqzR6hIY He goes into detail about how these types of libraries are particularly difficult or impossible to fuzz. He uses OpenSSL as an example but I would imagine an http library being similar.

haberman 10y ago
> He goes into detail about how these types of libraries are particularly difficult or impossible to fuzz. I just watched the video on 2x and I don't think that's a fair summary. He seems positive on fuzzing in general and mentions that fuzzing found two extremely tricky bugs in libsndfile and flac. He does point out that there are some cases like OpenSSL that are particularly difficult to fuzz completely because they are encrypted and heavily stateful, creating transient keys on the fly and such. I don't think HTTP has this problem, for the most part. Cool to see a video of Erik de Castro Lopo though -- I've worked with that guy since the early 2000s when I was working on Audacity (which uses his excellend libsndfile internally -- or at least did at the time).