Securing C code that seems to work just fine
summary
Fastly builds an MVP self-service fuzzing pipeline that runs persistent fuzzers against private C repos (edge HTTP/2 services and a varnish-cache fork), copying OSS-Fuzz patterns but adding SSH access and corpus persistence. CI compiles production with GCC while running clang sanitizers and UBSan to catch integer wrap and UB; a daily-maintained fuzz cluster finds multiple high/critical crashes and has produced coordinated fixes. Ops teams get training to detect memory-corruption indicators in production.
AI-written summary · about
chapters (10)
- 0:00Start
- 10:17High-growth startups
- 10:51C security tools
- 16:34Minimum viable product
- 17:49What is fuzzing?
- 19:19Heroic fuzzing
- 21:19Continuous fuzzing MVP strategy
- 21:47Development (2)
- 25:09Optimism bias
- 26:41Support secure operations
related talks
24mWhy you should be using automated fuzzing to test for security issues in your code
22mWriting safe and secure code
01h 15mMake your programs more reliable with Fuzzing
25mHow fuzzing helps to find bugs
31m“Fuzz or lose..."
53mFuzz Testing for Fun and Profit
39mMaking Fuzzing Part of Your Software Development Lifecycle
39mFuzzing Session: Finding Bugs and Vulnerabilities Automatically