3 ms·
> false positives... 10Mo URL crashes my Python interpreter? I'm ok with that. Either you're wrong about the "false" part or you're testing the wrong entry poi
by morelisp 4y ago
> false positives... 10Mo URL crashes my Python interpreter? I'm ok with that.
Either you're wrong about the "false" part or you're testing the wrong entry point.
Fuzzing has a long warmup time but probably the lowest false positive rate of any testing technique - if it crashes you're wrong about some invariant, even if that's only "I need to fuzz parseX, not decodeX".
- BiteCode_dev 4y agoFor one entry point, fuzzing may found 30 ways to crash it, none of which you care about. A thing is only a bug if it's a problem for use case your users will have an issue with.
- qingdao99 4y agoI think it just depends on how critical the software is. If it's just a webpage running in your browser then it's not a big deal if it crashes on some weird input. If it's a database, each crash can cause huge amounts of damage.