4 ms·

Black Duck products https://www.blackduck.com/fuzz-testing.html https://www.blackduck.com/fuzz-testing.html OpenText products https://www.opentext.com/produc

Black Duck products https://www.blackduck.com/fuzz-testing.html https://www.blackduck.com/fuzz-testing.html OpenText products https://www.opentext.com/products/dynamic-application-security-testing https://www.opentext.com/products/dynamic-application-securi... I won’t say how much they are here but they are very expensive.

tptacek 5mo ago
Just to be clear: your claim is that the Black Duck fuzzer would have enabled the rapid discovery of kernel vulnerabilities in macOS?
- firesteelrain 5mo ago
  Question was about high licensing fees and which tools I was referring to I’m not claiming Defensics or OpenText DAST tools are magical “find all kernel vulns” buttons My point is more that mature fuzzing ecosystems already existed before the recent AI-driven approaches. Protocol fuzzers, syscall fuzzers, coverage-guided fuzzers, sanitizers, dynamic analysis, etc. have all historically found serious kernel bugs
  - tptacek 5mo ago
    We might just be talking past each other. My question, from upthread, is this: the heyday of AFL was over a decade ago. Every major platform company fuzzes at a scale that I think is difficult for lay practitioners to get their heads around. They contract, quarterly, soup-to-nuts assessments from competing software security companies, who get full source access and are measured against each other by the quality of their findings. They run bounty programs specifically to direct public researcher attention to these exact findings. Why didn't "mature fuzzing ecosystems" find the vulnerabilities AI is now finding? It's a pretty big gap in the "fuzzing tools already do this" logic!
    - firesteelrain 5mo ago
      > Why didn't "mature fuzzing ecosystems" find the vulnerabilities AI is now finding? It's a pretty big gap in the "fuzzing tools already do this" logic! Because they simply aren’t ran. That’s my entire argument
      - tptacek 5mo ago
        You're wrong about that.
        firesteelrain 5mo ago
        How? If the tools were ran the same findings may have occurred.
        tptacek 5mo ago
        No, the point is they are very different tools that produce very different outcomes. Your syllogism doesn't work.
        firesteelrain 5mo ago
        Claude et al have “skills” that are basically containers of tools. It’s not a huge leap to say that similar tools are in use within these containers or even same. We don’t know.
        tptacek 5mo ago
        Yes, we do.
        firesteelrain 5mo ago
        Getting alot of short line replies. Got any link to any documentation / traceability to that claim?

tptacek 5mo ago

Just to be clear: your claim is that the Black Duck fuzzer would have enabled the rapid discovery of kernel vulnerabilities in macOS?

firesteelrain 5mo ago
Question was about high licensing fees and which tools I was referring to I’m not claiming Defensics or OpenText DAST tools are magical “find all kernel vulns” buttons My point is more that mature fuzzing ecosystems already existed before the recent AI-driven approaches. Protocol fuzzers, syscall fuzzers, coverage-guided fuzzers, sanitizers, dynamic analysis, etc. have all historically found serious kernel bugs
- tptacek 5mo ago
  We might just be talking past each other. My question, from upthread, is this: the heyday of AFL was over a decade ago. Every major platform company fuzzes at a scale that I think is difficult for lay practitioners to get their heads around. They contract, quarterly, soup-to-nuts assessments from competing software security companies, who get full source access and are measured against each other by the quality of their findings. They run bounty programs specifically to direct public researcher attention to these exact findings. Why didn't "mature fuzzing ecosystems" find the vulnerabilities AI is now finding? It's a pretty big gap in the "fuzzing tools already do this" logic!
  - firesteelrain 5mo ago
    > Why didn't "mature fuzzing ecosystems" find the vulnerabilities AI is now finding? It's a pretty big gap in the "fuzzing tools already do this" logic! Because they simply aren’t ran. That’s my entire argument
    - tptacek 5mo ago
      You're wrong about that.
      - firesteelrain 5mo ago
        How? If the tools were ran the same findings may have occurred.
        tptacek 5mo ago
        No, the point is they are very different tools that produce very different outcomes. Your syllogism doesn't work.
        firesteelrain 5mo ago
        Claude et al have “skills” that are basically containers of tools. It’s not a huge leap to say that similar tools are in use within these containers or even same. We don’t know.
        tptacek 5mo ago
        Yes, we do.
        firesteelrain 5mo ago
        Getting alot of short line replies. Got any link to any documentation / traceability to that claim?