3 ms·

"He went into the project figuring that he wouldn't find any vulnerabilities with the dumb fuzzer. "But I found bugs, lots of bugs. That was both surprising and

"He went into the project figuring that he wouldn't find any vulnerabilities with the dumb fuzzer. "But I found bugs, lots of bugs. That was both surprising and disappointing." And it also made him ask why vendors like Microsoft, Apple and Adobe, which have teams of security engineers and scores of machines running fuzzers looking for flaws, hadn't found these bugs long ago." Or, maybe the companies have already found those bugs and more, but focus their efforts on bugs that surface in the wild and don't spend resources on the others. If they fix all the bugs, then they spend money on some bugs that would never have surfaced. Just a guess.

viraptor 17y ago
That seems to make sense from the business point of view (well - not every business works like that, but I'm sure there are people out there who would agree). Unfortunately. Maybe internet needs more hackers these days? Leaving bugs unresolved should never equal saving money.
tptacek 17y ago
Waiting to fix bugs until they become an issue is smart, if a bit ruthless. Waiting to fix security flaws until they become public is negligent. From firsthand experience with at least one of the companies implicated in the recent stories: they aren't sitting on things. What Charlie Miller is finding is news to them.
aidenn0 17y ago
At one company I worked for, we introduced a fuzzer into the testing of one of our products. Due to a longer than normal release cycle, we were able to collect data on bugs customers found vs bugs the fuzzer found. A lot of bugs the fuzzer found were not found by customers, but a lot of the bugs found by the customers were found by the fuzzer. Furthermore the bugs encountered by the fuzzer identified modules that tended to be buggy and allowed even more bugs to be found by inspection in them. I guess it comes down to how much you value you place on fixing bugs before customers run into them. I certainly feel like in the case of security issues, the value is very high, especially since this is a class of bugs that attackers will specifically search for!

viraptor 17y ago

That seems to make sense from the business point of view (well - not every business works like that, but I'm sure there are people out there who would agree). Unfortunately. Maybe internet needs more hackers these days? Leaving bugs unresolved should never equal saving money.

tptacek 17y ago

Waiting to fix bugs until they become an issue is smart, if a bit ruthless. Waiting to fix security flaws until they become public is negligent. From firsthand experience with at least one of the companies implicated in the recent stories: they aren't sitting on things. What Charlie Miller is finding is news to them.

aidenn0 17y ago

At one company I worked for, we introduced a fuzzer into the testing of one of our products. Due to a longer than normal release cycle, we were able to collect data on bugs customers found vs bugs the fuzzer found. A lot of bugs the fuzzer found were not found by customers, but a lot of the bugs found by the customers were found by the fuzzer. Furthermore the bugs encountered by the fuzzer identified modules that tended to be buggy and allowed even more bugs to be found by inspection in them. I guess it comes down to how much you value you place on fixing bugs before customers run into them. I certainly feel like in the case of security issues, the value is very high, especially since this is a class of bugs that attackers will specifically search for!