Talk:Fuzzing

message: Acoording to this article, open-source software is inheritently less secure than closed-source software -- this is quite surprising since one of the major claims of the open source enthutiasts is that open source is more secure than closed source.
The problem is the following sentence: Since major customer and enterprise management software is starting to be open-source, database-based security attacks are becoming more credible.
Whomever wrote that, should clarify why, being open source, this is so. 
After having read the sentence again, I think it should also be clarified what exactly is ment -- are open source database systems less secure or are open source databases (systems?) used somehow in attacking other systems? And more importantly, just why is this realted to fuzzing at all?
FrederikHertzum (talk) 14:32, 25 September 2008 (UTC)
replies: text: Oddly, there is a security connection between open source software and fuzzing, but it is not what you might expect. Fuzzing treats the software as a "black box", in which none of the internal workings (including source code) are visible. Because fuzzing is so effective at finding glitches without source code and because some of the earliest fuzzing experiments showed the FSF's GNU suite of Unix tools to be more robust than any proprietary equivalents, open-source proponents sometimes cite fuzzing as yet another reason people should not rely on the false security through obscurity provided by closed-source software. I'm not sure about adding this to the article, however. While this information is citable, I'm not sure that it has encyclopedic worth. Thoughts? Ben (talk) 06:05, 19 August 2014 (UTC)
thread_title:  Open source cited as inheriently insecure 

message: The introduction to the article appears to give credit for the idea of fuzz testing to Barton Miller and students in 1989. Yet at the bottom of the page, there is a link to folklore.org describing how fuzz testing was being done on the Mac on 1983! It seems that fuzz testing might have originated independently several times, perhaps with the Wisconsin group being the first to publish it, at least in a major journal (CACM, I think?). It might be more appropriate to have a "history" section on the page which discusses these multiple origins, instead of giving all the credit to one group.
I agree with the dubiousness of this being created in 1989; I know that I personally used it in 1985, and I didn't invent it at that time, as I had heard of others doing it. Not sure if it was published, but certainly it was already widely known in 1985. - Glenn
: Precisely, someone started a page on fuzzing history. It has been unchanged since 2008 but seems correct. The contents of this page should be merged into the Fuzz testing page, and the Mac 1983 folklore.org you mention should also be added. 188.111.75.64 (talk) 18:17, 1 May 2013 (UTC)
thread_title:  Credit 

message: why the two way links between Glitching and fuzz testing. i fail to see the connection. —The preceding unsigned comment was added by 189.172.38.108 (talk) 22:22, 10 February 2007 (UTC)
thread_title: Glitching? 

message: Article says "There are at least two different forms of fuzz testing:" and proceeds to show 3 bullets.
The last bullet should be outside the list, or the text above should say "...three..."  —Preceding unsigned comment added by 61.11.49.253 (talk) 11:55, 28 December 2007 (UTC)
thread_title:  "There are at least two different forms of fuzz testing" 

message: I think whoever wrote this article didn't know what mutation analysis was. It's not comparable to fuzz testing at all, as M.A. is for testing the test suite, not (directly) for finding bugs. I've deleted the whole paragraph discussing differences between the two.
--Povman (talk) 00:32, 21 May 2008 (UTC)
thread_title:  Mutation analysis 

message: I´ve kicked out MuDynamics company marketing because of unnecessary blabla. They should improve their systems before they go and make marketing for low price fuzzers that are only available on an apliance that is not scalable or otherwise working good. They have focus on a very small band of protocols and they cannot be used on mobile things (would you carry an appliance weighing multi pounds to test a wireless access point - hahahaha). - Anonymous
But shouldn't there be an overview of the Fuzz testing products available? For example, I would add gremlins.js , which does this for JS apps. - Dsernst (talk) 13:15, 17 July 2014 (UTC)
thread_title:  Company marketing 

message: i propose to remove this text since it's not really related to this topic. this page is allegedly about fuzz testing then this section talks about how fuzz testing isn't good enough (are value judgments germane?) and goes on to promote a particular company's technology:
:"Robustness testing" was introduced by PROTOS researchers in 1999 (most of them now part of Codenomicon, headquartered in Oulu, Finland) to increase the test efficiency through systematic tests.PROTOS - Security Testing of Protocol Implementations Robustness testing is a model based fuzzing technique, an extension of syntax testing, that systematically will explore the input space defined by various communication interfaces or data formats, and will generate intelligent test cases that find crash-level flaws and other failures in software. The technique is described in a University of Oulu white paper on Robustness Testing published in 2000, by Kaksonen et al.
i really don't see why this belongs on this page at all; go create a page on robustness testing and say whatever is relevant to that subject on that page  —Preceding unsigned comment added by T0pgear09 (talk • contribs) 07:53, 28 March 2009 (UTC)
thread_title:  More marketing 

message: if i dont hear back by 35 march (ok, i mean 4 april lol :) i'll go ahead and do what i suggested; if someone objects i guess they can revert the change (but i still think they should have to make a convincing argument to put it back since it seems off-topic for this page) T0pgear09 (talk) 05:35, 30 March 2009 (UTC)
thread_title:  How long shall I wait for comments on the proposal above? 

message: i feel like the text i removed stoodd out since it was about some alternative to the subject of the page but that description boiled down to a commercial for a company, not a description of the technology that probably should be on its own page anyway, not the anti-page within this page ;) T0pgear09 (talk) 04:26, 4 April 2009 (UTC)
thread_title:  Ok i did it 

message: thuis pg is in my watchlist and so i noted recent changes; other than removing Peacock terms per WP:PEACOCK and re-wording a bit seems ok to me
i cant helep but wondeer if hte person means this org in finland: http://www.ee.oulu.fi/research/ouspg/ which is not exactly what is referred to in the text provided but maybee the name the person wrote is the orig name? come to think of it, i think the mention of a company in this line is outside the bounds of an ext link and i;ll do another edit to remove just that bit and ill chng the name of the group to whats on the website  —Preceding unsigned comment added by T0pgear09 (talk • contribs) 05:55, 1 May 2009 (UTC)
thread_title:  Peacock terms removed 

message: I don't visit here often but I just caught up on edits over the last year. Maybe the Network Statgey Partners reference I added back was originally removed by mistake? It now has a home near all the other links to commercial papers on fuzzing. Informationh0b0 (talk) 17:28, 30 September 2009 (UTC)
thread_title:  added back a reference and a clarification 

message: The computer science litterature does not equate random testing with fuzz testing. Only Wikipedia does this. 
 
In general, fuzzing is a particular form of (black-box or white-box) random testing. 
See, e.g.,
   Patrice Godefroid, Michael Y. Levin, and David Molnar
   SAGE: Whitebox Fuzzing for Security Testing
   Communications of the ACM, 2012.
   http://research.microsoft.com/en-us/um/people/pg/public_psfiles/cacm2012.pdf
which defines "blackbox fuzzing" as "a form of blackbox random testing, which randomly mutates well-formed program inputs and then tests the program with those modified inputs".
Yet, Wikipedia redirects "random testing" to "fuzz testing". Because Wikipedia takes things in the other way round, the explanations are nothing but confusing.
Vasywriter (talk) 19:37, 8 April 2013 (UTC)
replies: text: The fact there is a redirect between random testing and fuzz testing is not an endorsement that they two terms mean the same thing. I suggest that you look at the history of that "article" to determine how that happened. Since the term is not frequently used in the software development world and since no articles point there, it's not really an issue. If you actually want to resolve the issue, we can nominate that article for deletion. Walter Görlitz (talk) 20:26, 8 April 2013 (UTC)

text: Then computer science literature should get updated. Software testing literature often provides clear distinctions. Check StickyMinds.com Walter Görlitz (talk) 17:37, 18 March 2016 (UTC)
thread_title:  Random testing != fuzz testing 

message: Hello fellow Wikipedians,
I have just added archive links to  on Fuzz testing. Please take a moment to review my edit. If necessary, add  after the link to keep me from modifying it. Alternatively, you can add  to keep me off the page altogether. I made the following changes:
*Added archive http://web.archive.org/web/20110718122610/http://wurldtech.com/resources/SB_002_Robustness_Testing_With_Achilles.pdf to http://wurldtech.com/resources/SB_002_Robustness_Testing_With_Achilles.pdf
When you have finished reviewing my changes, please set the checked parameter below to true or failed to let others know (documentation at ).
Cheers.—cyberbot IITalk to my owner:Online 03:19, 29 February 2016 (UTC)
thread_title:  External links modified 

message: A PDF of the the last article in the list exists at http://langsec.org, which I linked to in the last change (presently reverted as  "Copyright violation. © 2014 IEEE and the site is not IEEE").  As far as I can tell, this is the author-posted "accepted version" of the article at his web page.  (Compare https://www.ieee.org/documents/author_faq.pdf Sec. 2.)  That this is indeed the author's web page can be verified (at present, this may change) by visiting http://www.cs.dartmouth.edu/~sergey/langsec/ and observing that it's identical to http://langsec.org, including the remark in the lower left corner.  ("Please link to this page as http://langsec.org/.")
As such, the copyright violation claim should be bogus.  Unless further complaints are voiced, I will attempt to revert the revert once in a few hours or so. 2A02:F28:1:D:50B9:DD7C:5B4B:5485 (talk) 01:35, 21 November 2016 (UTC)
replies: text: Since IEEE articles are not written by individuals, but by committee, no single author can be identified. As such you claim is invalid. IEEE holds the copyright to all of its documents. Walter Görlitz (talk) 04:08, 21 November 2016 (UTC)
thread_title:  Further reading / PDF link 

message: I am restructuring this article. I am a senior research fellow and have been working on the topic of automated software testing for my PhD and well into my postdoctoral time. I've always felt that the page on fuzzing does not reflect the recent contributions and viewpoints of security researchers and practitioners. The article was clearly unorganized and convoluted with scattered discussions and topics of arbitrary importance. So, I opened an account just for the purpose of rewriting this article. I am new to Wikipedia, so feel free to clean up syntactically or to remind me if I happen to violate some policy. For instance, I am not very sure how to reference (PDFs of) conference or journal papers. If you have any suggestions for interesting topics to discuss, please leave them below. E.g.,
# Adding the Heartbleed and other incidents that could be found via fuzzing.
# Adding the uses of fuzzers as vulnerability detection tool, together with ASAN or other memory debuggers. Small discussion of oracle problem.
# If we decide to merge, then monkey testing would be merged into fuzzing. All monkey testers are fuzzers, but not all fuzzers are monkey testers.
Ikkeer (talk) 13:48, 11 March 2017 (UTC)
replies: text: That's all good, but only if the new content is well sourced. Walter Görlitz (talk) 16:35, 11 March 2017 (UTC)
replies: text:  Sure. Let me know where you'd like additional citations. Ikkeer (talk) 00:46, 12 March 2017 (UTC)
thread_title:  Rewriting 

message: I added Fuzz Stati0n to the list of companies offering cloud based fuzzing (in addition to Google and Microsoft) but the edit was reverted. 
To justify the edit: Fuzz Stati0n was founded on July 16th, 2016 as a Delaware LLC. It was announced at a meetup on Sept 7th, 2016 that Fuzz Stati0n is offering a cloud based fuzzing service and that was covered in the press (please see the sidebar.) 
To justify the order,  Microsoft announced Project Springfield on Sept 26, 2016. 
Fuzz Stati0n has also had more press and won an award.
Disclaimer: I am the founder of the company. 
Thank you,
Grajagandev (talk) 19:51, 7 September 2017 (UTC)
thread_title:  Add Fuzz Stati0n to the list of companies offering cloud based fuzzing