4 ms·
I would have a look at Project Zero. P.S. I think many governments and corporations would keep their fuzzing techniques quite secret. You don't want to do the
by thornjm 10y ago
I would have a look at Project Zero.
P.S. I think many governments and corporations would keep their fuzzing techniques quite secret. You don't want to do the same fuzzing as anyone else.
- k__ 10y agoReally? I thought everyone dropped "security by obscurity" long time ago.
- arsenide 10y agoBy itself, sure: but it can only help if used in tandem with other methods
- thornjm 10y agoI was actually thinking along the lines of fuzzing for exploit development. You want a unique bug that will last a long time. In which case, your fuzzing techniques are a trade secret. A lot of fuzzing advances take place behind closed doors. Project Zero has some people with interesting backgrounds doing bug hunting for good.
- roddux 10y agoI hold the belief that Google must be getting something else out of Project Zero other than just "we hire the best hackers" bragging rights. I figure they're selling exploits (the ones they don't publicise) to governments.
- TickleSteve 10y agocontrary to popular opinion.... Obscurity is effective as one layer in a layered defense. "Defense in depth".