clusterfuzz

Scalable fuzzing infrastructure. (by google)

Clusterfuzz Alternatives

Similar projects and alternatives to clusterfuzz

NOTE: The number of mentions on this list indicates mentions on common posts plus user suggested alternatives. Hence, a higher number means a better clusterfuzz alternative or higher similarity.

clusterfuzz reviews and mentions

Posts with mentions or reviews of clusterfuzz. We have used some of these posts to build our list of alternatives and similar projects. The last one was on 2024-03-16.
  • Fuzzing Ladybird with tools from Google Project Zero
    2 projects | news.ycombinator.com | 16 Mar 2024
    https://github.com/google/clusterfuzz

    At least Chromium has integrated multiple different fuzzers into their regular development workflow and found lots of bugs even before going public.

  • An ex-Googler's guide to dev tools
    7 projects | news.ycombinator.com | 17 Jul 2022
    Then it is clear that the behavior of this for loop is either not important or not being tested. This could mean that the tests that you do have are not useful and can be deleted.

    > For most non-trivial software the possible state-space is enormous and we generally don't/can't test all of it. So "not testing the (full) behaviour of your application is the default for any test strategy", if we could we wouldn't have bugs... Last I checked most software (including Google's) has plenty of bugs.

    I have also used (setup, fixed findings) using https://google.github.io/clusterfuzz/ which uses coverage + properties to find bugs in the way C++ code handles pointers and other things.

    > The next question would be let's say I spend my time writing the tests to resolve this (could be a lot of work) is that time better spent vs. other things I could be doing? (i.e. what's the ROI)

    That is something that will depend largely on the team and the code you are on. If you are in experimental code that isn't in production, is there value to this? Likely not. If you are writing code that if it fails to parse some data correctly you'll have a huge headache trying to fix it? Likely yes.

    The SRE workbook goes over making these calculations.

    > Even ignoring that is there data to support that the quality of software where mutation testing was added improved measurably (e.g. less bugs files against the deployed product, better uptime, etc?)

    I know that there are studies that show that tests reduce bugs but I do not know of studies that say that higher test coverage reduces bugs.

    The goal of mutation testing isn't to drive up coverage though. It is to find out what cases are not being exercised and evaluating if they will cause a problem. For example mutation testing tools have picked up cases like this:

       if (debug) print("Got here!");
  • ClusterFuzz is a scalable fuzzing infrastructure
    1 project | news.ycombinator.com | 25 Apr 2022
  • A note from our sponsor - SaaSHub
    www.saashub.com | 10 May 2024
    SaaSHub helps you find the best software and product alternatives Learn more →

Stats

Basic clusterfuzz repo stats
3
5,206
9.8
3 days ago

Sponsored
SaaSHub - Software Alternatives and Reviews
SaaSHub helps you find the best software and product alternatives
www.saashub.com