> It's okay to want better tools. Based on the article I think that "better tool" is the fuzzer. As it points out remote exploits are overwhelmingly caused by

> It's okay to want better tools. Based on the article I think that "better tool" is the fuzzer. As it points out remote exploits are overwhelmingly caused by bad input validation. These sorts of bugs can be found with fuzzing. Even if you're using a "memory safe" language you should still be fuzzing because uncaught exceptions and panics are bugs and improperly recovering from one without sanitizing state could lead to a security hole. Incidentally, as the article notes, the CVE reports we keep hearing about are coming from Microsoft and Google. One has to wonder whether this speaks more about these companies priorities than the tech. Do consider that it wasn't until Heartbleed that these companies finally decided to devote serious resources to the OpenSSL project. Do note that Heartbleed was discoverable with a fuzzer.