Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 20 Nov 2014 16:50:21 +0100
From: Hanno Böck <>
Subject: Re: Fuzzing project brainstorming

Am Thu, 20 Nov 2014 08:38:38 -0700
schrieb Kurt Seifried <>:

> The most important part of all: who's going to interpret the fuzzing
> results and then co-ordinate with upstreams to make source code fixes?

Well, the answer to that is: the people who do the fuzzing.

My main aim is to make more transparent what's already going on. That's
not going to change who does the fuzzing and how it gets reported.

There lays deeper a question that I asked myself already: What's an
"okay" way of reporting these things?
Basically what I usually did is just sending crash samples to upstream
devs and add some valgrind/asan output. One could argue that I'm
offloading the real work to the upstream devs, however I feel they know
their code better than I do (and often I'm just not qualified to create
the fix). Until now I feel most upstreams were okay with that.

Hanno Böck


Download attachment "signature.asc" of type "application/pgp-signature" (820 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.