3 ms·
I agree that it's not testing in the strict sense, but fuzzing isn't really testing either. The work done by a a theorem prover and a fuzzer isn't all that dif
by Retr0id 3y ago
I agree that it's not testing in the strict sense, but fuzzing isn't really testing either.
The work done by a a theorem prover and a fuzzer isn't all that different (and sufficiently advanced fuzzers use SMT solvers etc.)
- NovemberWhiskey 3y agoThis seems to neglect the fundamental difference between static and dynamic analysis. Formal methods approaches don’t usually need me to run my code.
- _flux 3y agoI guess I need to disagree :). Why isn't fuzzing testing? Ultimately it ends up running the code and seeing if it works—for some definition of "working", that is, it doesn't crash—even if it may pick the ways it chooses the input by considering how the code behaves while running it. Also, how is even "smart fuzzing" similar to theorem provers in any way? Fuzzers still think in terms of runs, but a theorem considers all cases. The best fuzzer wouldn't be able to tell if a sort algorithm works for all inputs, presuming the input size is unbounded. Actually, my understanding is that a fuzzer wouldn't be able to prove if identity function works for all kinds of objects it may be given.
- dllthomas 3y agoI think fuzzing is doing testing, but often using other techniques (including sometimes formal methods) to improve the effectiveness of that testing.