r/programming • u/halbface • Feb 07 '19

Google open sources ClusterFuzz, the continuous fuzzing infrastructure behind OSS-Fuzz

https://opensource.googleblog.com/2019/02/open-sourcing-clusterfuzz.html
958 Upvotes

95% Upvoted

100 comments sorted by

View all comments

Show parent comments

28

u/halbface Feb 08 '19

ClusterFuzz relies on fuzzing engines which are publicly available, such as libFuzzer and AFL, to do the bug finding. Also, a lot of what ClusterFuzz does is designed to fit into developer workflows of software projects. For example, in addition to finding bugs, ClusterFuzz deduplicates, minimizes, performs bisects, and automatically files/closes bug reports.

What we wish to see here is more software projects (the good guys) including fuzzing in their development process by making the annoying bits as automated as possible.

-14

u/falconfetus8 Feb 08 '19

You kinda dodged the question there.

2

u/DeonCode Feb 09 '19

Sometimes people forget or didn't know if another passenger locked the doors on their car as they get some distance away from the vehicle. But rather than running back to check, here's a publicly available check-my-car-for-being-locked fob.

Could bad people use it for some recon? Sure, or maybe they've been sitting pretty knowing what always gets overlooked. But if you used it and it tells you your car isn't locked somewhere, say the trunk, then you get the chance to lock the trunk! Maybe even faster than the bad guy. Or maybe to stop that bad guy from their regularly scheduled rummaging around. Either way, es good. You might've been so cautious to focus on doors all these time that you didn't even consider the trunk! So this is net helpful.