I used to think writing safe code in C/C++ was a matter of skill. However, after finding more than a few issues with AFL at a FAANG in code written by engineers with the highest engineering title, I changed my mind. Incredible tool.

This is a great list.

I had been playing with and building fuzzers long before AFL, but its release and its ability to explore the code space in a smart way fundamentally changed the game. Never once have I improved a codebase so it could be fuzzed and didn't get a payoff of it finding bugs.

And the field is relatively young. Like the other year built a fuzzer with a transformer model as the internal learning engine and other cool stuff like https://antithesis.com

I know fuzzing has been around forever, but it is still surprising how many engineers I encounter who have never used one. I hate fixing bugs and love tools that just find bugs and gave me exact reproducible cases. It was nice to see GoLang get a built in fuzzer to try to help it become more mainstream.

And these days with AI where you need ways it both can't gamify (a unit test that simply returns 'pass') as well as automatic ways to eval generate code fuzzing is a great fit. And not to mention that it is cheaper to fuzz all night than continuously burn tokens looking for ways to crash the code.

These are good tips, thank you

[flagged]

[flagged]