Hacker News Reader

> false positives... 10Mo URL crashes my Python interpreter? I'm ok with that.

Either you're wrong about the "false" part or you're testing the wrong entry point.

Fuzzing has a long warmup time but probably the lowest false positive rate of any testing technique - if it crashes you're wrong about some invariant, even if that's only "I need to fuzz parseX, not decodeX".

View on HN

For one entry point, fuzzing may found 30 ways to crash it, none of which you care about.

A thing is only a bug if it's a problem for use case your users will have an issue with.

I think it just depends on how critical the software is. If it's just a webpage running in your browser then it's not a big deal if it crashes on some weird input. If it's a database, each crash can cause huge amounts of damage.

Reply on news.ycombinator.com