Re:Afl.rs: Fuzzing Rust code with american-fuzzy-lop
by comex on Tuesday June 21, 2016 @03:46AM
(#11944122)
> 1. Get approval from the open source team (for each minor version).
> 2. Start a security approval process (for each minor version).
> [etc...]
Out of curiosity, do you think having a laborious process to adopt even minor versions actually improves security?
Because to me, since in most software exploitable bugs are often fixed without being explicitly marked as such or CVE-ed, this seems like basically a recipe for insecurity.
I could be wrong. And I know that even if you disagreed with the process, that wouldn't mean that you didn't have to follow it, or that many, many developers in a multitude of environments similar to yours don't have to follow similar processes. But I'm curious what you think.
> 2. Start a security approval process (for each minor version).
> [etc...]
Out of curiosity, do you think having a laborious process to adopt even minor versions actually improves security?
Because to me, since in most software exploitable bugs are often fixed without being explicitly marked as such or CVE-ed, this seems like basically a recipe for insecurity.
I could be wrong. And I know that even if you disagreed with the process, that wouldn't mean that you didn't have to follow it, or that many, many developers in a multitude of environments similar to yours don't have to follow similar processes. But I'm curious what you think.