4 ms·

I work on this. Happy to answer questions if people have any.

by metzmanj 8y ago

devy 8y ago
Hi, good stuff! I am curious to know why it was primarily written in Python (according to GitHub 83.3%)?
- saagarjha 8y ago
  Python is great for writing glue code, so I'm not particularly surprised by the language choice.
- tracker1 8y ago
  Just generally speaking, code that does orchestration and testing in general is often easier under a dynamic scripted language over something that is built and compiled, even if it winds up as a custom DSL. I think Python is one of the better options here for the broader community support, and tooling. Aside: I tend to reach for node/js often for similar reasons (despite detractors) mostly because I'm more comfortable with it over Python or Ruby, but also because it's already integrated to most of the build/test environments I'm working on anyway.
- aboutruby 8y ago
  That's one of the main languages at Google. And there are moving towards more Go since a few years.
- kortilla 8y ago
  I’m curious why you seem to be surprised? It’s one of the most popular languages (even within Google).
AndrewKemendo 8y ago
How does the decision get made at Google to open source something? I'm always confused about what gets shut down vs open sourced vs paid product.
- snazz 8y ago
  I would guess that it has to do with the usefulness of the project outside of Google. This project could be applied to so many other things (as OSS-Fuzz demonstrates), so open-sourcing it makes perfect sense. It isn’t some kind of classified algorithm, either.
- asdkfjasl 8y ago
  Open sourcing is usually pushed from the bottom. People decide they care about open sourcing their project at they push for it.
- joshsimmons 8y ago
  Hi there! I work in the Google Open Source Programs Office. Echoing what others have said, it's usually just a matter of an engineer or team deciding it's something they want to do. Other times, it's a strategic choice. We open sourced our open source policies/docs a while back, so if you're so inclined you can dig deeper there. These two links will be of particular interest: https://opensource.google.com/docs/creating/ https://opensource.google.com/docs/creating/ and https://opensource.google.com/docs/why/ https://opensource.google.com/docs/why/
  - metzmanj 8y ago
    +1 I can speak a little bit about what motivated us. We saw from OSS-Fuzz (https://github.com/google/oss-fuzz https://github.com/google/oss-fuzz) that this sort of thing could be widely useful and wanted non-open source code to benefit from making fuzzing easier.
  - AndrewKemendo 8y ago
    Thanks Josh! Love the meta-open sourcing.
legohead 8y ago
I am quite ignorant on this subject. I looked briefly through the docs, and still feel a little lost. So before I go too much further, would it be possible to use this for web apps or unity games?
- metzmanj 8y ago
  >So before I go too much further, would it be possible to use this for web apps or unity games? Web apps, almost certainly no. ClusterFuzz (and fuzzing generally) is most useful for finding bugs in C/C++ code so maybe it could work for unity games? I don't know much about them though.
  - Insanity 8y ago
    I thought unity was mostly written in either C# or an EcmaScript flavour?
    - ritz_labringue 8y ago
      Unity itself (the engine) is written in C++. Game scripts are written in either C# or UnityScript iirc.
      - pjmlp 8y ago
        Although the engine is currently written in C++, they are in the process of rewriting parts of it in C#, with help of their HPC# subset and Burst compiler, having some ex-Insomniac Games developers like Mike Acton on the team.
xiphias2 8y ago
Is this the fuzzing tool that was used to find bugs in Bitcoin? I don't see it in the repository.
- metzmanj 8y ago
  I don't think so. But solidity was recently added to OSS-Fuzz: https://github.com/google/oss-fuzz/tree/master/projects/solidity https://github.com/google/oss-fuzz/tree/master/projects/soli...
wyldfire 8y ago
Keep up the good work, Johnathan! This is a great feature.
q3k 8y ago
Any plans to port this from GCE APIs to something more provider agnostic, like k8s? A lot of us would like to fuzz on on-prem equipment.
- metzmanj 8y ago
  We would like to support this use case. For now, you can actually do the fuzzing on prem while communicating with app engine. We do this for our OS X bots since GCE doesn't offer OS X.
  - deleted 8y ago
    [deleted]
- metzmanj 8y ago
  The other possibility for completely on-prem use right now is running it using the dev server: https://google.github.io/clusterfuzz/getting-started/local-instance/ https://google.github.io/clusterfuzz/getting-started/local-i...
j88439h84 8y ago
How does it compare to afl?
- metzmanj 8y ago
  It uses AFL. ClusterFuzz is infrastructure for running fuzzers, so we use it to run AFL, libFuzzer, and other domain specific fuzzers we've written. Using it to run AFL gives us a lot of nice things over using AFL on someone's desktop (such as crash deduplication, automatic issue filing, fixed testing, regression ranges etc.)
tanin 8y ago
Congrats, Jonathan!
- metzmanj 8y ago
  Thanks Tanin!

I work on this. Happy to answer questions if people have any.

devy 8y ago

Hi, good stuff! I am curious to know why it was primarily written in Python (according to GitHub 83.3%)?

saagarjha 8y ago
Python is great for writing glue code, so I'm not particularly surprised by the language choice.
tracker1 8y ago
Just generally speaking, code that does orchestration and testing in general is often easier under a dynamic scripted language over something that is built and compiled, even if it winds up as a custom DSL. I think Python is one of the better options here for the broader community support, and tooling. Aside: I tend to reach for node/js often for similar reasons (despite detractors) mostly because I'm more comfortable with it over Python or Ruby, but also because it's already integrated to most of the build/test environments I'm working on anyway.
aboutruby 8y ago
That's one of the main languages at Google. And there are moving towards more Go since a few years.
kortilla 8y ago
I’m curious why you seem to be surprised? It’s one of the most popular languages (even within Google).

AndrewKemendo 8y ago

How does the decision get made at Google to open source something? I'm always confused about what gets shut down vs open sourced vs paid product.

snazz 8y ago
I would guess that it has to do with the usefulness of the project outside of Google. This project could be applied to so many other things (as OSS-Fuzz demonstrates), so open-sourcing it makes perfect sense. It isn’t some kind of classified algorithm, either.
asdkfjasl 8y ago
Open sourcing is usually pushed from the bottom. People decide they care about open sourcing their project at they push for it.
joshsimmons 8y ago
Hi there! I work in the Google Open Source Programs Office. Echoing what others have said, it's usually just a matter of an engineer or team deciding it's something they want to do. Other times, it's a strategic choice. We open sourced our open source policies/docs a while back, so if you're so inclined you can dig deeper there. These two links will be of particular interest: https://opensource.google.com/docs/creating/ https://opensource.google.com/docs/creating/ and https://opensource.google.com/docs/why/ https://opensource.google.com/docs/why/
- metzmanj 8y ago
  +1 I can speak a little bit about what motivated us. We saw from OSS-Fuzz (https://github.com/google/oss-fuzz https://github.com/google/oss-fuzz) that this sort of thing could be widely useful and wanted non-open source code to benefit from making fuzzing easier.
- AndrewKemendo 8y ago
  Thanks Josh! Love the meta-open sourcing.

legohead 8y ago

I am quite ignorant on this subject. I looked briefly through the docs, and still feel a little lost. So before I go too much further, would it be possible to use this for web apps or unity games?

metzmanj 8y ago
>So before I go too much further, would it be possible to use this for web apps or unity games? Web apps, almost certainly no. ClusterFuzz (and fuzzing generally) is most useful for finding bugs in C/C++ code so maybe it could work for unity games? I don't know much about them though.
- Insanity 8y ago
  I thought unity was mostly written in either C# or an EcmaScript flavour?
  - ritz_labringue 8y ago
    Unity itself (the engine) is written in C++. Game scripts are written in either C# or UnityScript iirc.
    - pjmlp 8y ago
      Although the engine is currently written in C++, they are in the process of rewriting parts of it in C#, with help of their HPC# subset and Burst compiler, having some ex-Insomniac Games developers like Mike Acton on the team.

xiphias2 8y ago

Is this the fuzzing tool that was used to find bugs in Bitcoin? I don't see it in the repository.

metzmanj 8y ago
I don't think so. But solidity was recently added to OSS-Fuzz: https://github.com/google/oss-fuzz/tree/master/projects/solidity https://github.com/google/oss-fuzz/tree/master/projects/soli...

wyldfire 8y ago

Keep up the good work, Johnathan! This is a great feature.

q3k 8y ago

Any plans to port this from GCE APIs to something more provider agnostic, like k8s? A lot of us would like to fuzz on on-prem equipment.

metzmanj 8y ago
We would like to support this use case. For now, you can actually do the fuzzing on prem while communicating with app engine. We do this for our OS X bots since GCE doesn't offer OS X.
- deleted 8y ago
  [deleted]
metzmanj 8y ago
The other possibility for completely on-prem use right now is running it using the dev server: https://google.github.io/clusterfuzz/getting-started/local-instance/ https://google.github.io/clusterfuzz/getting-started/local-i...

j88439h84 8y ago

How does it compare to afl?

metzmanj 8y ago
It uses AFL. ClusterFuzz is infrastructure for running fuzzers, so we use it to run AFL, libFuzzer, and other domain specific fuzzers we've written. Using it to run AFL gives us a lot of nice things over using AFL on someone's desktop (such as crash deduplication, automatic issue filing, fixed testing, regression ranges etc.)

tanin 8y ago

Congrats, Jonathan!

metzmanj 8y ago
Thanks Tanin!