4 ms·

If you completely understood your system and how it behaved you wouldn't need those fuzzing. Or stress testing. It's because we build lousy software with lossy

If you completely understood your system and how it behaved you wouldn't need those fuzzing. Or stress testing. It's because we build lousy software with lossy interfaces and strangely-undefined interactions that these tools exist. They're used when someone says "we'll never really know what's going on there, just throw some tooling at it and maybe we'll get lucky!" One would hope we would try to make software more like the former than the latter.

ludovicianul 4y ago
Fuzzing is just a measure to monitor that you didn't miss any areas. You might guard your code using well defined patterns or behaviours, but you cannot be perfect at it. Fuzzing will make sure you do this consistently.
vlovich123 4y ago
Sorry no. No matter how good you are, unless you’ve formally proven your system correct or it’s a trivial program, your system likely has bugs. Humans aren’t perfect and a program has a combinatorial explosion of states - each condition in your system multiples the number of possible states by 2. Fuzzing, property testing and mutation testing are attempts to get an inherently complex system under control. Typically, these approaches are also cheaper than formal proofs to develop which is really important because engineering isn’t just building the thing. It’s evolving the thing, maintaining it, and the cost of all of this in manpower is absolutely critical to consider. Think Space Shuttle design where you have to get everything right up front vs SpaceX’s fail fast approach.
yjftsjthsd-h 4y ago
> If you completely understood your system and how it behaved you wouldn't need those fuzzing. Or stress testing. Only in the same sense where if people just wrote perfect bug free code then we would not have to test. Tragically, people are not omniscient or perfect programmers, so tools remain useful.
__MatrixMan__ 4y ago
Yes, of course. We should also just drive safer and then we won't need seatbelts.
guenthert 4y ago
> If you completely understood your system I think that sets an unnecessarily low upper bound on the complexity of the system. Did Feynman completely understood the Space Shuttle when investigating the Challenger disaster? Perhaps, but we can't always rely on having a Nobel laureate at hand.
- charlieflowers 4y ago
  And even then, unfortunately, this was after the analogous "fuzz test" had already failed horrifically. (Not making a dark joke ... I'm pointing out that even the Nobel laureate wasn't allocated and focused in time to prevent the problem, which furthers your argument).
BiteCode_dev 4y ago
If you were to just run faster than Usain Bolt, you would not need training.

ludovicianul 4y ago

Fuzzing is just a measure to monitor that you didn't miss any areas. You might guard your code using well defined patterns or behaviours, but you cannot be perfect at it. Fuzzing will make sure you do this consistently.

vlovich123 4y ago

Sorry no. No matter how good you are, unless you’ve formally proven your system correct or it’s a trivial program, your system likely has bugs. Humans aren’t perfect and a program has a combinatorial explosion of states - each condition in your system multiples the number of possible states by 2. Fuzzing, property testing and mutation testing are attempts to get an inherently complex system under control. Typically, these approaches are also cheaper than formal proofs to develop which is really important because engineering isn’t just building the thing. It’s evolving the thing, maintaining it, and the cost of all of this in manpower is absolutely critical to consider. Think Space Shuttle design where you have to get everything right up front vs SpaceX’s fail fast approach.

yjftsjthsd-h 4y ago

> If you completely understood your system and how it behaved you wouldn't need those fuzzing. Or stress testing. Only in the same sense where if people just wrote perfect bug free code then we would not have to test. Tragically, people are not omniscient or perfect programmers, so tools remain useful.

__MatrixMan__ 4y ago

Yes, of course. We should also just drive safer and then we won't need seatbelts.

guenthert 4y ago

> If you completely understood your system I think that sets an unnecessarily low upper bound on the complexity of the system. Did Feynman completely understood the Space Shuttle when investigating the Challenger disaster? Perhaps, but we can't always rely on having a Nobel laureate at hand.

charlieflowers 4y ago
And even then, unfortunately, this was after the analogous "fuzz test" had already failed horrifically. (Not making a dark joke ... I'm pointing out that even the Nobel laureate wasn't allocated and focused in time to prevent the problem, which furthers your argument).

BiteCode_dev 4y ago

If you were to just run faster than Usain Bolt, you would not need training.