4 ms·
That's a pretty impressive response - committing to fuzzing with AFL, improving current fuzzing test coverage, adding new coding guidelines, and a paid security
by staticassertion 10y ago
That's a pretty impressive response - committing to fuzzing with AFL, improving current fuzzing test coverage, adding new coding guidelines, and a paid security audit.
In regards to 4 (valgrind) perhaps utilizing other sanitizers would be a good idea.
Awesome that they tested whether those methods would actually have caught this bug - and multiple did. That's a smart metric.
And a writeup about TMP and compile time safety to boot.
I'm struggling to come up with anything more that I'd want in a disclosure.
- kentonv 10y agohttps://twitter.com/BenLaurie/status/575079375307153409 https://twitter.com/BenLaurie/status/575079375307153409 :) The sad part of the story is that Cap'n Proto actually hasn't had a release since then, so (so far) I've effectively gotten out of doing any of those release-oriented things I promised. Many changes have gone into git master, but Sandstorm used git master directly, meaning there wasn't sufficient incentive to do the work of a release. (And as an understaffed startup we could never quite justify spending the time.) The good news is that I joined Cloudflare two weeks ago, who is a big Cap'n Proto user, and it looks like I'll have more time and justification to do releases there. (And yes, I do intend to fulfill all the promises in doing so.)
- staticassertion 10y ago> The good news is that I joined Cloudflare two weeks ago, who is a big Cap'n Proto user, and it looks like I'll have more time and justification to do releases there That's great news, thanks for the disclaimer/ info.