News for hackers. Stuff that matters.
Re:Fuzzing Ladybird with tools from Google Project Zero by classichasclass on Saturday March 16, 2024 @11:21AM (#39726692)
And thus demonstrated is the value of lots of different implementations of a spec. Already one hole found in the spec in just this article, and I'm sure there will be/were more.
Re:Fuzzing Ladybird with tools from Google Project Zero by awesomekling on Saturday March 16, 2024 @11:44AM (#39726902)
Yes indeed! We've found and reported lots of issues in the various HTML, CSS and JS specs.

Multiple independent implementations are crucial for the long-term health of the web platform, so we're trying to do our part! :)

Re:Fuzzing Ladybird with tools from Google Project Zero by Avamander on Saturday March 16, 2024 @12:38PM (#39727322)
> Multiple independent implementations are crucial for the long-term health of the web platform, so we're trying to do our part! :)

It's really great that you're doing this work. This principle also applies to many other specs. I've implemented a few and found multiple issues with real-world impact.

Re:Fuzzing Ladybird with tools from Google Project Zero by de4np on Saturday March 16, 2024 @05:45PM (#39729766)
Awesome! Thank you for being the change you want to see. Inspiring to say the least, great work!
Re:Fuzzing Ladybird with tools from Google Project Zero by spencerchubb on Saturday March 16, 2024 @07:23PM (#39730344)
Why couldn't the fuzzer be used to discover the bug in the popular browsers?
Re:Fuzzing Ladybird with tools from Google Project Zero by summerlight on Saturday March 16, 2024 @11:31PM (#39731704)
https://github.com/google/clusterfuzz

At least Chromium has integrated multiple different fuzzers into their regular development workflow and found lots of bugs even before going public.

Re:Fuzzing Ladybird with tools from Google Project Zero by TomNomNom on Sunday March 17, 2024 @09:53AM (#39734487)
A bug in the spec doesn't necessarily mean there will be a noticeable bug in the browsers; e.g. a crash.

The browsers may have been written to "work" / not crash over adhering strictly to the spec.

Re:Fuzzing Ladybird with tools from Google Project Zero by dataflow on Saturday March 16, 2024 @11:32PM (#39731714)
> And thus demonstrated is the value of lots of different implementations of a spec. Already one hole found in the spec

That's a bit of a... non-sequitur. Imagine if you had tweeted "eggplants are my favorite vegetables", someone corrected you "actually they're fruits", and then you declared: "And thus demonstrated is the value of Twitter! Someone already made me a better-informed citizen in response to my tweet." This feels kind of similar.

This isn't to say what they're doing isn't valuable, or that there isn't value in having lots of implementations of a spec. Just saying that implication isn't there (yet) with this particular example.