andrei

Joined 8 years ago

Karma

236

Submissions

57

Member since

Oct 2

console.com

View on Hacker News

Recent submissions

Comment · 2 years ago

just link to the real thing :) [0]

[0]: https://twitter.com/nealagarwal/status/1747284257582506102

Comment · 3 years ago

facepalm I read that paragraph, but my brain skipped that sentence for some reason. Thanks for clarifying

Comment · 3 years ago

How is this different than just turning your TV off? I feel like I'm missing something

Comment · 4 years ago

Somewhat relevant: https://tonsky.me/blog/disenchantment/

Comment · 4 years ago

As of go 1.18, fuzzing is built into the toolchain itself, and is what we're using in this post.

We go over the basics here [0], if you'd like to start at the beginning

[0]: https://blog.fuzzbuzz.io/go-fuzzing-basics/

Comment · 4 years ago

It's much more common than you may think - especially at larger organizations where engineers go "off-script" frequently.

That being said, we wanted to highlight an example of how fuzzing can be applied to a typical (albeit, toy) API to find logic bugs, and figured SQL Injection would be something that resonated with most (all?) developers.

Comment · 4 years ago

A lot of folks we talk to think fuzzing is only useful for finding memory leaks in C++ programs, so we wanted to show how adding a single fuzz test to your API can find SQL injection and other logic bugs.

Would love to hear others' experience with Go fuzzing now that it's been out for a few months.

Fuzzing Go APIs for SQL Injection blog.fuzzbuzz.io

64 andrei 4 years ago 22 comments

Comment · 4 years ago

> 2. What measures is Oven taking to proactively detect and mitigate vulnerabilities? (e.g.: fuzzing, audits, bug bounties)

We're huge fans of bun at Fuzzbuzz (waiting for it to get a bit more production-ready). If Jarred's interested, we'd be happy to donate some compute to support fuzzing Bun.

<hn username> @ fuzzbuzz.io

House passes bill that DoD software can’t have any CVEs twitter.com

19 andrei 4 years ago 9 comments

Advanced Go Fuzzing Techniques blog.fuzzbuzz.io

2 andrei 4 years ago 0 comments

Comment · 4 years ago

I've heard this talked about before, and I believe there's a phrase for it, but I don't remember. Do you happen to know?

Comment · 4 years ago

Good catch :) fixed!

Comment · 4 years ago

It does! Fuzzing actually started off as a tool built by security researchers to find vulnerabilities in parsers, and other complex codebases, usually written in C/C++ (looking for memory bugs). So anything that deals with untrusted binary data is a prime candidate for fuzz testing.

Go’s fuzzing framework supports `[]byte` arguments as well as all of the standard Go primitives, so you should be able to test netcode this way.

If you're looking for a C/C++ solution, my recommendation is libfuzzer [0]. We've also built our own C/C++ fuzzing engine at Fuzzbuzz [1].

[0] https://llvm.org/docs/LibFuzzer.html

[1] https://docs.fuzzbuzz.io/docs/getting-started-in-c-or-c++