Continuous Fuzzing Best Practices
summary
Covers integrating fuzz testing into CI for C, C++ , Go and Rust projects, with a focus on continuous fuzzing practices and challenges. Describes libFuzzer (including a demo), current state of continuous fuzzing and of C/C++ open-source projects, and presents case studies and best-practice solutions for running continuous fuzzing (including on systemd).
AI-written summary · about
chapters (16)
- 0:00Intro
- 0:34A bit about me
- 1:48What is Fuzzing / Fuzz Testing
- 3:06What to Fuzz?
- 4:46Quick history & Types of fuzzers
- 6:05ParseComplex Example
- 6:57Random vs Coverage guided fuzzing Algorithm
- 8:36Coverage Guided Fuzzing - Demo
- 9:53Data generation
- 10:55Property based fuzz testing
- 12:08Solutions and What Fuzzing is not
- 14:30Challenges
- 16:35Continuous Fuzzing - Options
- 18:17Continuous Fuzzing Workflow
- 20:50Continuous Trophies
- 22:00Future
related talks
31m“Fuzz or lose..."
42mDevSecOps: Fuzzing Source Code
39mMaking Fuzzing Part of Your Software Development Lifecycle
39mFuzzing Session: Finding Bugs and Vulnerabilities Automatically
47mFuzzing Your Code
38mPkgFuzz Project: A New Continuous Fuzzing for Open Source Software
36mFuzzing the CNCF Landscape
44mFuzzing in Go: Fear, Despair, Acceptance and the Long-Awaited Success