6 ms·

The paper has been published a while ago. We have been improving Mayhem quite a bit since then, and we recently ran it on debian binaries. It found many crashes

The paper has been published a while ago. We have been improving Mayhem quite a bit since then, and we recently ran it on debian binaries. It found many crashes, that are not necessarily exploits. 1.2K is the number of bug reports we are going to submit to the Debian bug tracker.

dfc 13y ago
As a long time Debian user I would like to thank you for choosing Debian as a target platform. The maintainers might not appreciate the bugs in the short term but in the long term this is great for everyone involved. Was there any reason why you chose Debian? I imagine bts made things easier for bug wrangling/submission.
- joeyh 13y ago
  Having received one of the bugs (that was not exploitable), I appreciated it in the short term. :P I hope a free version of this can be built, it would be a nice additional QA step to run before release.
  - dfc 13y ago
    I see that it is for moreutils. I am having the hardest time using the interface for forallsecure.com. It seems that you can not search by package. When I browsed through the list I figured I would have come across moreutils around page 49/51 but I did not see it. I am tempted to download: http://forallsecure.com/programs/1 ... http://forallsecure.com/programs/22630 But that seems like a waste of everyone's resources. What was the bug? For people unfamiliar with joeyh's contribution to Debian it is important to note that he is a legendary DD: http://qa.debian.org/developer.php?login=joeyh%40debian.org http://qa.debian.org/developer.php?login=joeyh%40debian.org
    - bugfinder 13y ago
      Our interface is severely lacking. The website is mostly for internal use at the moment. I'll try to add a program search tonight to make it more usable. As a matter of fact, most programs are not linked to packages, and most packages are not present, including moreutils. You won't find it even by crawling.
      - dfc 13y ago
        No worries. I will choose helping Debian over interface improvements anyday:) Again, thanks for choosing Debian.
    - joeyh 13y ago
      Actually, I have not received the one for moreutils yet. However, we got 1 report for the Debian Installer, which I hope means only 1 problem was found.. which is nice, as the d-i code is mostly not written with this kind of robustness in mind.
      - lysium 13y ago
        I read the mailing list post as the authors willingly restricted the number of reported bugs to one to avoid spamming the BTS.
        joeyh 13y ago
        Since d-i is split into a ton of components, we know that all but 1 of them had 0 bugs found.
      - bugfinder 13y ago
        44 reports got delayed, including the one for moreutils. It should be in your mailbox now.
- bugfinder 13y ago
  The response has been fairly positive in general, and it's great to see that some of the bugs have already been fixed! All Mayhem developers are using Debian, and our cluster is running Debian as well. We've been using it happily for years. That's why we chose to analyze it first. I believe we will also have an impact on other distributions since bugs are getting fixed upstream.
  - stass 13y ago
    Thanks for the great work! Do you plan to release the tool one day? It will be a great asset to other operating systems developers as well.
lysium 13y ago
I see. Thanks for the response. Also, thanks for choosing Debian and not some other closed source software.

dfc 13y ago

As a long time Debian user I would like to thank you for choosing Debian as a target platform. The maintainers might not appreciate the bugs in the short term but in the long term this is great for everyone involved. Was there any reason why you chose Debian? I imagine bts made things easier for bug wrangling/submission.

joeyh 13y ago
Having received one of the bugs (that was not exploitable), I appreciated it in the short term. :P I hope a free version of this can be built, it would be a nice additional QA step to run before release.
- dfc 13y ago
  I see that it is for moreutils. I am having the hardest time using the interface for forallsecure.com. It seems that you can not search by package. When I browsed through the list I figured I would have come across moreutils around page 49/51 but I did not see it. I am tempted to download: http://forallsecure.com/programs/1 ... http://forallsecure.com/programs/22630 But that seems like a waste of everyone's resources. What was the bug? For people unfamiliar with joeyh's contribution to Debian it is important to note that he is a legendary DD: http://qa.debian.org/developer.php?login=joeyh%40debian.org http://qa.debian.org/developer.php?login=joeyh%40debian.org
  - bugfinder 13y ago
    Our interface is severely lacking. The website is mostly for internal use at the moment. I'll try to add a program search tonight to make it more usable. As a matter of fact, most programs are not linked to packages, and most packages are not present, including moreutils. You won't find it even by crawling.
    - dfc 13y ago
      No worries. I will choose helping Debian over interface improvements anyday:) Again, thanks for choosing Debian.
  - joeyh 13y ago
    Actually, I have not received the one for moreutils yet. However, we got 1 report for the Debian Installer, which I hope means only 1 problem was found.. which is nice, as the d-i code is mostly not written with this kind of robustness in mind.
    - lysium 13y ago
      I read the mailing list post as the authors willingly restricted the number of reported bugs to one to avoid spamming the BTS.
      - joeyh 13y ago
        Since d-i is split into a ton of components, we know that all but 1 of them had 0 bugs found.
    - bugfinder 13y ago
      44 reports got delayed, including the one for moreutils. It should be in your mailbox now.
bugfinder 13y ago
The response has been fairly positive in general, and it's great to see that some of the bugs have already been fixed! All Mayhem developers are using Debian, and our cluster is running Debian as well. We've been using it happily for years. That's why we chose to analyze it first. I believe we will also have an impact on other distributions since bugs are getting fixed upstream.
- stass 13y ago
  Thanks for the great work! Do you plan to release the tool one day? It will be a great asset to other operating systems developers as well.

lysium 13y ago

I see. Thanks for the response. Also, thanks for choosing Debian and not some other closed source software.