4 ms·
> Recent security stories confirm that errors like buffer overflow and use-after-free can have serious, widespread consequences when they occur in critical open
by seanwilson 10y ago
> Recent security stories confirm that errors like buffer overflow and use-after-free can have serious, widespread consequences when they occur in critical open source software.
This project is awesome and incredibly valuable but what alternatives are there to making the libraries it checks more secure besides rewriting them in another language? When languages exist where buffer overflows and use-after-free are essentially impossible it's a bit depressing that we have to rely on fuzzing unless fuzzing can find these kinds of bugs with high reliability?
- tanin 10y ago> what alternatives are there to making the libraries it checks more secure besides rewriting them in another language? I'm not sure what you mean by rewriting a library. For example, if a library is written in Ruby, fuzzing might not be suitable. you shouldn't rewrite it in C, so that you can fuzz it. (I thinkI misunderstand your point here. Please correct me.) If we want to discover vulnerabilities in Ruby, we should fuzz the Ruby VM directly. We shouldn't fuzz a Ruby library.