Tips for more effective fuzz testing with AFL++

(nullprogram.com)

51 points | by luu 4 days ago

3 comments

  • jonhohle 1 hour ago
    I used to think writing safe code in C/C++ was a matter of skill. However, after finding more than a few issues with AFL at a FAANG in code written by engineers with the highest engineering title, I changed my mind. Incredible tool.
    • fasterik 1 hour ago
      It is a matter of skill to a large extent, though. A skilled programmer will write fewer bugs on average than an unskilled one. They'll know the patterns to avoid and have a higher bar for quality. Nobody can write 100% bug-free code, independent of programming language. Also, job title might correlate with skill but it doesn't rule out incompetence at the highest levels.
      • ambicapter 25 minutes ago
        It doesn't really matter, the most skilled programmers are usually working on harder stuff, so the bug rate remains fairly consistent.
      • Neywiny 53 minutes ago
        I think it's mostly a testing thing. Valgrind is a friend a lot of people haven't heard of for c/c++. Setting up good regression tests is an art. Maintaining them is even harder.
    • PorciiVorbesc 17 minutes ago
      >I used to think writing safe code in C/C++ was a matter of skill.

      It's a matter of how many fucks the devs gave about doing quality work. You can find inexperienced people deliver quality work simply because they're passionate and they care (Half-Life was made in part by people with no prior game or coding experience), and you can find supposed rockstars deliver slop because for whatever reason they don't care, they just want to punch in, collect paychecks, then punch out.

      FAANG stopped being a benchmark of skill a while ago. It's a skill of griding leetcode and 7 stage interviews to get it, then resting and vesting till you can jump ship to something better or get mass layd off.

  • monster_truck 1 hour ago
    These are good tips, thank you
  • botquests 1 hour ago
    [flagged]