Date: Thu, 20 Nov 2014 20:23:09 +0100 From: Hanno Böck <hanno@...eck.de> To: oss-security@...ts.openwall.com Subject: Re: Re: Fuzzing project brainstorming On Thu, 20 Nov 2014 08:52:15 -0800 "M.T. Roebuck" <marvint.roebuck@...ox.lv> wrote: > Maybe my problem is that your proposal seems herculean to me but > can't help to think it's a reminder or sign that we need to think > past the current state of things. Compared to "starting from scratch" starting such a fuzzing project is not herculean, it's more like grabbing the low hanging fruit. But arguments alike come up every now and then. Basically you'll hear two things: "We have to mitigate / sandbox" and "please rewrite everything in [insert favorite non-C programming language]". I don't want to downplay either of these approaches. It's just that you have to be realistic. Nobody will rewrite everything from scratch in rust/go/haskell/whatever any time soon. There are a few interesting projects that try to rewrite key sofware in safer languages (mitls and servo come to mind), but they are few and none of them is in a production state. Our systems we have today - the ones we use to have this discussion, manage our bank accounts and surf the web - have imperfect software written mostly in unsafe languages. I feel fuzzing can improve the state of things a lot. -- Hanno Böck http://hboeck.de/ mail/jabber: hanno@...eck.de GPG: BBB51E42 Download attachment "signature.asc" of type "application/pgp-signature" (820 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.