News for hackers. Stuff that matters.

A comment on Browser Fuzzing at Mozilla. Parent comment

Re:Browser Fuzzing at Mozilla by lqqq on Tuesday February 09, 2021 @09:58PM (#26085295)
AFL is not that smart. If you only do bit flippings on the inputs, then fuzzing a JavaScript engine/dom engine will take forever. The "domino" (Mozilla internal tool) looks quite powerful as it generates semantically correct dom. Sadly, it is not open source. Google has a tool designed specifically to fuzz JavaScript engines, Fuzzilli[1], which hackers have been using for bug hunting.

[1]: https://github.com/googleprojectzero/fuzzilli

[ Parent | on HN ]
Re:Browser Fuzzing at Mozilla by pabs3 on Tuesday February 09, 2021 @11:24PM (#26085734)
I wonder why domino hasn't been released? Is Mozilla selling it to other companies?
[ Parent | on HN ]
Re:Browser Fuzzing at Mozilla by sylvestre on Wednesday February 10, 2021 @03:03AM (#26086649)
Because it often finds security issues in our code: see the graph at the end of the blog post.

If opensource, this fuzzer could be used against our users...

AFAIK, Mozilla doesn't sell any software!

[ Parent | on HN ]
Re:Browser Fuzzing at Mozilla by glandium on Wednesday February 10, 2021 @04:23AM (#26087120)
Mozilla sells VPN products ;) But no, not these tools.
[ Parent | on HN ]
Re:Browser Fuzzing at Mozilla by pabs3 on Thursday February 11, 2021 @10:50PM (#26110569)
VPN products are more like a service than selling software.
[ Parent | on HN ]