Conversation

Definitely in my⚡Top3 best papers! My fuzzing conjecture 2020 has just been accepted

(2xAccept, 1xAward Quality). Turns out there is no sudden road block; more like a frontier that is exponentially harder to push. 📄: mboehme.github.io/paper/FSE20.Em Collab w/

@gamozolabs

105

325

Replying to

and

Cool paper! A somewhat related thought that comes to mind: to find new bugs "faster" one would need to make a better fuzzer instead of trying to scale up existing ones.

Replying to

Even though both an old fuzzer X and a "better" new fuzzer Y get exponentially slower with discovering new species as they are discovered, Y will still be exponentially faster in doing the discovery than X (assuming the exponent bases are different). I wonder if that makes sense.

Replying to

and

Excellent point and definitely worth looking into. You are saying that performance difference is essentially "compounding", right?

Replying to

and

Sorry, I'm not sure what "compounding" means :) What I mean is: say X discovers new species with rate 1/e^xn and Y with rate 1/e^yn (where y < x and n is the current number of found species), then Y is e^(x-y)n times "faster" than X to discover new species.

Replying to

And as n is growing, the "rate difference" e^(x-y)n is growing exponentially.

2:17 AM · May 23, 2020Twitter Web App

Replying to

and

This might require more thought (you simultaneously vary # inputs/min on 1 machine and # machines), but my intuition is that an exponential increase in the number of machines gives a linear increase in the *difference* between vulns discovered by X and Y.

Replying to

and

I'm not varying the # inputs/min or the # machines. When I'm saying that Y is "better" than X, I mean that Y uses better mutations or more relevant coverage metric, or something like that. But this might require more thought and more formal approach indeed :)