How we applied fuzzing techniques to cURL
blog.trailofbits.com
How we applied fuzzing techniques to cURL
1–10 of 84 posts
Re: How we applied fuzzing techniques to cURL
#2[flagged]
Re: How we applied fuzzing techniques to cURL
#3[flagged]
cURL is also embedded in a lot of applications. An exploit within curl could lead to a vulnerability in the host application.
Re: How we applied fuzzing techniques to cURL
#4[flagged]
The analogy sounds great and catchy (and sufficiently contrarian to get knee jerk upvotes from the site), but it really oversimplifies things and misses the mark on what types of problems fuzzing catches and why that's incredibly important in a project as popular as curl.
Re: How we applied fuzzing techniques to cURL
#5[flagged]
It's a tired argument. Running any program has risks.
Re: How we applied fuzzing techniques to cURL
#6[flagged]
The analogy sounds great and catchy (and sufficiently contrarian to get knee jerk upvotes from the site), but it really oversimplifies things and misses the mark on what types of problems fuzzing catches and why that's incredibly important in a project as popular as curl.
Indeed. It's more of an argument not to execute scripts downloaded from the web. Which is valid, but not the point of fortifying curl.
Re: How we applied fuzzing techniques to cURL
#7[flagged]
[deleted]
Re: How we applied fuzzing techniques to cURL
#8Earlier quoted context omitted.
The analogy sounds great and catchy (and sufficiently contrarian to get knee jerk upvotes from the site), but it really oversimplifies things and misses the mark on what types of problems fuzzing catches and why that's incredibly important in a project as popular as curl.
Indeed. It's more of an argument not to execute scripts downloaded from the web. Which is valid, but not the point of fortifying curl.
[deleted]
Re: How we applied fuzzing techniques to cURL
#9Earlier quoted context omitted.
The analogy sounds great and catchy (and sufficiently contrarian to get knee jerk upvotes from the site), but it really oversimplifies things and misses the mark on what types of problems fuzzing catches and why that's incredibly important in a project as popular as curl.
Indeed. It's more of an argument not to execute scripts downloaded from the web. Which is valid, but not the point of fortifying curl.
Would it make sense for cURL to detect when its being piped into `sh`?
Possibly have it refuse to proceed unless the site is on a whitelist or the user has added an --i-accept-the-risk option.
Re: How we applied fuzzing techniques to cURL
#10I am curious how much effort goes into creating and maintaining unit tests and fuzzing tests. Sometimes it takes longer / more lines of code to write thorough tests than it does to implement the core feature.
At that point, is it worth the time invested? Every new feature can take 2-3 times longer to deliver due to adding tests.