Day 4: Fuzzing
đź›¶ Mood: Looking forward to the long weekend.
🎵 Soundtrack: Oldies playing in another room and it’s raining
📚 Reading Github Issues
I started my day by reading the 25 new github issues that had been created since yesterday. Two topics caught my eye:
-
The first was about Go’s test coverage implemtnation. The occurs when there is code after a panic. It is obvious when looking at a sample that this code will never be run. However, Go will consider this code “covered”. Apparently this is a known issue in Go’s coverage implementation. (This is where I wish I had the jots emoji outside of slack.)
-
The second set of interesting issues were about fuzz: 1, 2, 3, 4, 5, 6. This led to the question: what is fuzzing?
đź§¶ Fuzzing
Fuzzing or fuzz testing is an automated software testing technique that involves providing invalid, unexpected, or random data as inputs to a computer program. The program is then monitored for exceptions such as crashes, failing built-in code assertions, or potential memory leaks. - Wikipedia
There are 3rd party developer tools like go-fuzz that do this, but now it is being added to Go itself.
📚 I read more about fuzzing in Go here:
- Fuzzing is Beta Ready
- Design Draft: First Class Fuzzing
- github issue: “testing: add fuzz test support”
I was able to get an example based on the one from the “Fuzzing is Beta Ready” blog post running. I can get it to (correctly) fail, but wasn’t able to see the value that caused it to fail. It is supposed to be in the GOCACHE somewhere, but I couldn’t find it. Also, I don’t think I got the mutator engine working?
🕵️‍ I’m going to need to play around with this more. There aren’t a ton of examples that I could find online. Most googling results show examples for go-fuzz and not the new beta features.
✨ Today’s Highlights
- I downloaded gotip for the first time to use the fuzz beta feature
- I commented on my (possibly?) first ever go issue with some very in-depth comments.
- I always associated “big-endian” with computer memory, but in the issue linked above, Russ Cox wrote: “Generally, we try to keep the flag names big-endian, so that related flags all have a common prefix, like bench, benchtime, benchmem; memprofile, memprofilerate; even fuzz, fuzzcachedir, fuzzminimizetime, fuzztime, fuzzworker”. I love that use of the word big-endian! I also love CLI consistency 👩‍🍳.
- I had a fun time thinking about algorithms again with the fuzz crash minimizer!