[C-safe-secure-studygroup] coverage, fuzzing, symbolic/concolic execution, and more

Wheeler, David A dwheeler at ida.org
Wed Jan 4 20:56:26 UTC 2017


Dynamic analysis, including fuzzing and traditional testing, requires that you be able to execute the code.  There are many circumstances where you have the source code but cannot run it directly (e.g., because you need special hardware).  In addition, many tool suppliers do only static analysis, or only dynamic analysis – not both.

I think it does *NOT* make sense to “bundle” these two different activities in a single spec.

I recommend that dynamic issues, like fuzzing and testing, be handled *separately* by a different spec or different group.

--- David A. Wheeler



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.trustable.io/cgi-bin/mailman/private/c-safe-secure-studygroup/attachments/20170104/b79f917d/attachment.html>


More information about the C-safe-secure-studygroup mailing list