TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

How Antithesis finds bugs

160 点作者 wwilson大约 1 年前

11 条评论

infogulch大约 1 年前
Have you tried to 'rediscover' classic (in)famous bugs? E.g. take an old version of OpenSSL vulnerable to heartbleed and run Antethesis on it to 'discover' heartbleed via fuzzing. It would be interesting to see how much fine tuning would be needed to discover it.
评论 #40071828 未加载
评论 #40071914 未加载
评论 #40071776 未加载
评论 #40072707 未加载
mrkmarron大约 1 年前
FYI playing Super Mario with fuzzing (AFL) was done in a fun 2020 S&amp;P paper. Also finds bugs and security issues.<p>&quot;IJON: Exploring Deep State Spaces via Fuzzing&quot; <a href="https:&#x2F;&#x2F;casa.rub.de&#x2F;fileadmin&#x2F;img&#x2F;Publikationen_PDFs&#x2F;2020_IJON_Exploring_Deep_State_Spaces_via_Fuzzing_Publication_ClusterofExcellence_CASA_Bochum.pdf" rel="nofollow">https:&#x2F;&#x2F;casa.rub.de&#x2F;fileadmin&#x2F;img&#x2F;Publikationen_PDFs&#x2F;2020_IJ...</a>
评论 #40069670 未加载
评论 #40068965 未加载
评论 #40069802 未加载
wwilson大约 1 年前
This is Will (I gave the talk linked in the post). Happy to answer any questions about this work, or how it generalizes to testing things that aren&#x27;t Nintendo games.
评论 #40069253 未加载
评论 #40069945 未加载
评论 #40068830 未加载
评论 #40071960 未加载
infogulch大约 1 年前
In Will&#x27;s talk he defines two terms related to optimizing fuzzers [2]: Strategy and Tactics.<p>Strategy is the datum you choose to optimize for as the fuzzer randomly walks the states of the system. E.g. optimize to maximize Mario&#x27;s X value, or optimize for reaching all tile positions etc. This generalizes the concept of &quot;coverage guided&quot; to include domain-specific details about your target program (e.g. that the program has the concept of a grid of possible positions).<p>Tactics is the choice of input distribution. Sometimes the frequency of the randomness should be tuned for the application. For example, randomly changing the state of the A button every frame is not a good frequency to properly test long jumps, maybe a normal distribution with average hold&#x2F;not hold time of 1s would be better. Also, encoding the randomness within the program&#x27;s valid domain can help avoid over-testing parsing&#x2F;validation code at the expense of more interesting code further in the program. [1][2]<p>[0]: Barton P. Miller, Lars Fredriksen, and Bryan So. 1990. An empirical study of the reliability of UNIX utilities. Commun. ACM 33, 12 (Dec. 1990), 32–44. <a href="https:&#x2F;&#x2F;doi.org&#x2F;10.1145&#x2F;96267.96279" rel="nofollow">https:&#x2F;&#x2F;doi.org&#x2F;10.1145&#x2F;96267.96279</a><p>[1]: This reference appears to be related: Rohan Padhye, Caroline Lemieux, Koushik Sen, Laurent Simon, and Hayawardh Vijayakumar. 2019. FuzzFactory: domain-specific fuzzing with waypoints. Proc. ACM Program. Lang. 3, OOPSLA, Article 174 (October 2019), 29 pages. <a href="https:&#x2F;&#x2F;doi.org&#x2F;10.1145&#x2F;3360600" rel="nofollow">https:&#x2F;&#x2F;doi.org&#x2F;10.1145&#x2F;3360600</a><p>[2]: I introduce the concept of fuzzing in another comment: <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=40068187#40071972">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=40068187#40071972</a>
Taikonerd大约 1 年前
Super Mario is such a fun example. Well chosen.
yanniszark大约 1 年前
This is fascinating! I thought only Reinforcement Learning was doing things like this but you&#x27;re saying you can do this via fuzzying? What does this mean exactly? How is it able to learn to advance through all these levels? Is there an underlying learning mechanism at play?
评论 #40071972 未加载
评论 #40070185 未加载
t4ng0pwn3d大约 1 年前
I see a lot of fuzzing tools for CLI apps, but are there any good alternatives for web applications&#x2F;APIs? I&#x27;ve used Hypothesis for generating random datas in requests but maybe there&#x27;s something better out there.
suprfnk大约 1 年前
@wwilson How do you define the X&#x2F;Y &quot;distance&quot; of a non-Mario application? I.e. any (distributed or not) system that doesn&#x27;t have a relatively trivial &quot;higher x&#x2F;y is better&quot; fitness function?
m3kw9大约 1 年前
If you just read it it sounds like a scam to some. Going thru all states does not find you bugs magically. You need to know what a bug is first or if it’s an actual intended feature. This article fails to explain it
bbor大约 1 年前
At what point can we start suing companies on behalf of the commons for taking words from the lexicon? I miss the days when this would be called “Wilson &amp; Co.’s automated testing solution” instead of such a beautiful, philosophically meaningful word. Same thoughts on that Devin.AI scam taking the name “Cognition” and Vercel somehow bribing their way into claiming the “ai” name on NPM.<p>Technically awesome post tho! Love the heatmap esp. Maybe bring up changing your name to investors because some rando online doesn’t like it though, please.
m3kw9大约 1 年前
Doesn’t explain how it finds bugs it’s just had the AI play Mario bros
评论 #40070843 未加载