Re:Open-Sourcing ClusterFuzz
by painful on Thursday February 07, 2019 @01:50PM
(#19107401)
How about people stop using unsafe languages such as C and C++?
[ Parent
| on HN ]
Rust without the use of unsafe code is considered by most to be a safe language but nonetheless, it's still useful to fuzz it to find logic bugs (like assert failures) or anything that triggers a panic (like out of bound array access or integer overflow).
More info: https://github.com/rust-fuzz
Disclaimer: I am the author of the rust fuzzer honggfuzz-rs.
Re:Open-Sourcing ClusterFuzz
by stormbeard on Thursday February 07, 2019 @02:37PM
(#19107822)
What planet do you live on? What do you think embedded/realtime systems, signal processing, graphics, and kernel developers are supposed to use? Also, what do you think these memory-safe, garbage collected, runtime environments are written in?
> What do you think embedded/realtime systems, signal processing, graphics, and kernel developers are supposed to use?
My guess is that they'd use Rust for new code.
Rust doesn't yet support every platform that C supports and training staff to use a new language and adding tooling to integrate a new language into an existing codebase is extremely expensive.
I don't even know Rust, so there's a reason I write low-level stuff like that in C/C++ ;)
Fuzzing is effective for more than finding memory related bugs. Parsing related crashed, code injection, unexpected state machine path can all also be revealed.
Beside, as much I agree with the benefits of a memory safe language, and I do believe in the urgency of promoting techs like rust, C and C++ are going to be part of our lifes for a lot of time.
If you gotta use knife, make sure you have the tools to make it sharp.