So @epakskape, I was wondering: how many of the memory safety bugs were found with fuzzing?https://twitter.com/TedMielczarek/status/1195916407889940480 …
-
-
Odgovor korisniku/ci @pati_gallardo
We don’t know for sure since most of the vulns MSRC addresses are reported without info on how it was found. The preferred bug finding method tends to vary based on the target and the bug finder
Fuzzing is preferred for many, but code review & program analysis are also common1 reply 0 proslijeđenih tweetova 4 korisnika označavaju da im se sviđa -
Odgovor korisnicima @epakskape @pati_gallardo
Anecdotally, I suspect that fuzzing is the source of a large proportion of the vulns we see.
@metr0 and@artwongt might be able to their perspective based on the vulns that their teams find.1 reply 1 proslijeđeni tweet 5 korisnika označava da im se sviđa
Because Microsoft already has a mature static analysis capability, our bugs are predominantly from fuzzing. A minority are from manual code review. Anecdotally, the majority of bounty-eligible external cases in Windows are from fuzzing.
Čini se da učitavanje traje već neko vrijeme.
Twitter je možda preopterećen ili ima kratkotrajnih poteškoća u radu. Pokušajte ponovno ili potražite dodatne informacije u odjeljku Status Twittera.