Jesse Ruderman on Firefox, security, and more
Today I'm releasing two fuzzers: jsfunfuzz, which tests JavaScript engines, and DOMFuzz, which tests layout and DOM APIs. Over the last 11 years, these fuzzers have found 6450 Firefox bugs, including 790 bugs that were rated as security-critical. I had to keep these fuzzers private for a long time because of the frequency with which […]
Fuzzers make things go wrong.Assertions make sure we find out. Assertions can improve code quality in many ways, but they truly shine when combined with fuzzing. Fuzzing is normally limited to finding obvious symptoms like crashes, because it's rare to be able to tell correct behavior from incorrect behavior when the input is generated randomly. […]
I have mixed feelings about requiring Mozillians to “agree†to the Mozilla Manifesto. I get the impression that many volunteers aren’t fond of “commercial involvement†(9). Firefox development often does not live up to the ideals of absolute security (4) or transparency (8), so we’d be asking new contributors to commit to behavior for which […]
Swings on BART (photo by Audrey Penven) Each of these apps makes transit more efficient or convenient. Together, they can do something almost magical: make transit attractive to urbanites who previously saw owning a car as a necessity. Planning your trips These apps try to find the best way to reach your destination by combining […]
My DOM fuzzer can now find bugs where the layout of a DOM tree depends on its history. In this example, forcing a re-layout swapped a “1†and “3†on the screen. My fuzzer didn’t know which rendering was correct, but it could tell that Firefox was being inconsistent. Initial DOM tree DIV ت SPAN […]
None of the major video rental systems appeal to me: Redbox is for people who visit the grocery store two days in a row. (Why don't they put kiosks at train stations?) Netflix DVD-by-mail is for people who watch lots of movies and check snail mail daily. Amazon Instant Video is for people who live […]