3 ms·

> Microsoft has been doing fuzzing for years. Then why do we need to rely on Google to fuzz Windows' kernel?

• zuzun 10y ago
  Obviously only Microsoft could explain why they missed these bugs. Maybe they never fuzzed the font parsing parts of the Windows kernel (what a weird thing to say). What I know is that the Project Zero people put a lot of effort into this and they had a large font corpus and mutated inputs based on domain-specific knowledge, maybe that was their key to success.
  • xorxornop 10y ago
    Also, there is selection bias at work here: we don't hear about all the stuff that the Microsoft fuzzing team does find. And I bet it's a lot. There's no real benefit to them to share their internal findings - it would effectively just be handing 0-days to malware authors on a plate, after all, affecting all users running older versions - and so we get this very skewed view.