Hacker News Reader

Comment by saagarjha | Hacker News Reader

Are there any benefits of running the fuzzer in-browser rather than on a native binary? Does the fizzier exercise different code paths for each? Do other bugs pop up?

View on HN

The potential application is hinted at with the slide "OSS-Fuzz@Home". Akin to the SETI@Home* mass-distributed computing project, this has the potential to scale in a HUGE way. Anyone with a web browser could simply load the fuzzer and contribute cycles... No need for any big downloads, any installs, special software, configuration or anything! Just visit a page and you're golden.

I wonder if Google will actually build on this. It's a great idea.

[1]: https://en.wikipedia.org/wiki/SETI@home

How would this work in practice? Most if not all browsers throttle background pages.

I don't think we have plans to build this for now.

I find it a really cool idea, but for now, running fuzzers natively on Google Cloud with ClusterFuzz (https://github.com/google/clusterfuzz) suits our needs.

One challenge for the WASM approach is it will always be at least as hard to build a project for WASM as it is for native.

I haven't done a comprehensive study of this but in general I find that fuzzing programs in different environments (e.g. CPU architectures, OSes) tends to find some bugs that won't be found by fuzzing in just one environment.

But in general, I agree a lot of the bugs in WASM apps could be found by fuzzing their native versions.

Reply on news.ycombinator.com