frewsxcv

Which app is immune to this?

Keeping something secret amongst 230 people is not an easy task. At some point the campaign has to become public, and it's better to do that in a planned, coordinated manner, than have it get leaked to the press.

> The unions require a certain amount of work experience to join and some have different levels of membership depending on how much work you do after joining.

To users who are following along who aren't familiar, this is not how all unions works. Presumably the commenter is talking about "trade unions" which is one of many types of unions.

"rebuttal" is giving them way too much credit

If something is untyped in Sorbet, you can give it a type with `T.let`. So if the return value of function `foo` is untyped, but you have a high degree of confidence that it will return a `String`, you can do `ret = T.let(foo, String)`

> We don't need laws to see these as a public good.

Yes, actually you do.

> that's why it's a 100% racist term against white people

yikes

Rust macros are intended to be powerful, by design.

I used to be in this situation. Then I started using https://convox.com/ and all my problems went away.

90% of Manhattan? Maybe. 90% of NYC? Definitely not.

https://en.wikipedia.org/wiki/Demographics_of_New_York_City

What do you find unstable about Rust?

In case you're looking for a place to jump in:

The thread that handles all the resources (http://, chrome://, file://, etc):

https://github.com/servo/servo/blob/master/components/net/re...

And here's the file that handles HTTP requests:

https://github.com/servo/servo/blob/master/components/net/ht...

I haven't, though I've thought about it. Most of the logic behind git2-rs (as far as I know) is written in C. While it's possible to run afl.rs on a Rust project that uses C code behind the scenes, I haven't ever attempted to get AFL instrumentation working on the underlying C code. I don't think it should be that difficult, I just haven't gotten around to it yet.

EDIT: I forgot to mention: It's possible to run AFL on uninstrumented code, it just won't be that smart about finding new code paths.

(afl.rs maintainer here)

I ran AFL on rust-brotli for a week a couple weeks ago. It didn't find anything. I plan to try again soon! No one is safe from AFL.

Looks like they use build with release mode:

https://github.com/TechEmpower/FrameworkBenchmarks/blob/mast...

Also worth mentioning the Rust library 'quickcheck' that does something similar to what you're suggesting:

https://github.com/BurntSushi/quickcheck#the-quickcheck-attr...

This is what I'm striving for:

    #[fuzz]
    fn test_fuzz(bytes: Vec<u8>) {
        ...
    }

This would live alongside other test cases and everytime fuzzing is desired, one could just do `cargo fuzz`. Relevant issues and a pull request:

https://github.com/frewsxcv/afl.rs/issues/24 https://github.com/frewsxcv/afl.rs/issues/31 https://github.com/frewsxcv/afl.rs/pull/46

There's still a little more work to do though. Mainly, I want to compile AFL as a part of the workflow (see the afl-sys crate in the repo) so the user doesn't need to manually install AFL to use `cargo fuzz`.

In this particular instance, there's no reason to be shipping afl.rs in production code. It's just a tool that's meant for local development, testing environments, or maybe even part of a CI workflow.

Huh, wasn't aware that's how afl-gcc worked. I'll have to look into it sometime, thanks for making me aware of it.

Yes, the shared acronym makes Googling for anything AFL related rather annoying. The results are usually a mixture of Australian football, American rabbits, and fuzz testing.

Regarding using stable builds of Rust with afl.rs: If I could, I would.

afl.rs uses a Rust compiler plugin to register the LLVM pass needed to instrument Rust programs so that AFL can run on them:

https://github.com/frewsxcv/afl.rs/blob/master/afl-plugin/li...

Compiler plugins in Rust are currently unstable, and as far as I know, are not on a path to stability in the near-term.

https://doc.rust-lang.org/book/compiler-plugins.html

If anything, it felt like I was practicing some sort of fuzz-driven-development for brotli-rs knocking out a bunch of corner cases.

Coincidentally though, I am fuzzing a different Brotli library testing some unpushed afl.rs changes: https://github.com/dropbox/rust-brotli-no-stdlib

Author here.

AFL is coverage-guided fuzz testing (fuzz testing that relies on code coverage).

Someone (not me) wrote an "LLVM pass" that loops through the generated LLVM IR for any LLVM-compiled program and injects the necessary AFL instrumentation such that AFL can work on it:

https://github.com/mirrorer/afl/blob/master/llvm_mode/afl-ll...

Since Rust uses LLVM when compiling a binary, all afl.rs does is incorporate this instrumentation and AFL just needs to be run on the resulting binary.

There are multiple versions of LLVM though. Rust is compiled using a specific version of LLVM. Since the LLVM pass above is reading the generated LLVM that Rust produces, the versions can't be too far off otherwise the LLVM pass might see some unrecognized symbols.

The README in the project suggests just compiling Rust which also compiles LLVM, then you'll have a version of LLVM that is guaranteed to be the same when you setup the instrumentation.

I think it might be sufficient to update the documentation to suggest the user of afl.rs just download and use LLVM 3.8 since this is the major version that Rust uses internally. I need to do more testing to confirm this will work for everyone, then I can update (and greatly simplify) the README.

Regarding your IDE question: https://areweideyet.com/

The version number is 0.11, which is different from 0.1.

I tried to create one of these a few months ago https://github.com/frewsxcv/lop.farm

Send me an email if you want to team up on this: [email protected]

In case anyone wants to learn about an effort to incrementally port some of the BoringSSL (fork of OpenSSL) primitives to Rust:

https://github.com/briansmith/ring

If anyone is looking to contribute and wants a "good first task", here are some tasks:

https://github.com/briansmith/ring/issues?q=is%3Aopen+is%3Ai...

Help is greatly appreciated :)