3 ms·
I tried to bring out 2 points in my comment: 1) The people who write the parsers should not write the fuzzers 2) Using fuzzers based upon more rigorous standar
by tshtf 17y ago
I tried to bring out 2 points in my comment:
1) The people who write the parsers should not write the fuzzers
2) Using fuzzers based upon more rigorous standards of the relevant file formats may not be optimal. There is an advantage to dumb fuzzers; with defense in depth one would use both.
- tptacek 17y agoI think that when you contract a senior consultant from iSec Partners or Leviathan to test, I don't know LiveMeeting?, you're getting a high-quality "deep" fuzzer and you're getting the dumb fuzzer too. They are getting both. They're spending many tens of thousands of dollars per release cycle to get people to write and run these tools. They evaluate projects based on whether they find things. They find things. They keep the tools and the run them on future releases. The point I'm making is, even if you do an amazing job fuzzing your software, you will clearly still miss things.