5 ms·

If this ever gets popular, it is just one more reason to strongly prefer free software, I guess, since it can't be "protected" with this.

• hannob 7y ago
  I have some bad news for you: There are developers of the Linux kernel who deploy anti-fuzzing techniques (CRCs, which is a surprisingly effective anti-fuzzing-technique) and think it's a good idea to reduce the number of people reporting fuzzing-bugs: https://marc.info/?l=linux-fsdevel&m=152410224900838&w=2 https://marc.info/?l=linux-fsdevel&m=152410224900838&w=2
  • saagarjha 7y ago
    I didn't draw that sort of conclusion at all from that email: isn't it just saying that the filesystem has a CRC (for reliability, presumably, not because they are trying to deter fuzzers) and they're frustrated that they keep getting fuzzer reports for things that don't pass that check (and don't matter because they're caught by the CRC)? They have a specific suite of CRC-aware fuzzers that they're still using.
  • feanaro 7y ago
    The other poster already handled the issue that this is not talking about the same thing, but filesystem-specific CRCs. But why would you think it a good thing if less people reported unfixed bugs?
• 283b 7y ago
  What prevents free software from using this technique?
  • saagarjha 7y ago
    Nothing, but attackers can just compile their own versions without these obfuscations to fuzz.
  • feanaro 7y ago
    As the other poster said, any such technique would have to be rather easily removable on the source side in order not to be a maintainability nightmare.