osv.dev

ion, GPUs, TPUs/NPUs, Hypervisors, OS schedulers, IPC,] Still though, coverage-based fuzzing; From https://news.ycombinator.com/item?id=30786239 : > OSS-Fuzz runs CloudFuzz[Lite?] for many open source repos and feeds OSV OpenSSF Vulnerability Format: https://github.com/google/osv#current-data-sources From "Automated Unit Test Improvement using Large Language Models at Meta" https://news.ycombinator.com/item?id=39416628 : > "Fuzz target generation using LLMs" (2023), OSSF//fuzz-introspector* > gh topic: https://github.com/topics/coverage-guided-fuzzing The Fuzzing computational task is similar to the Genetic Algorithm computational task, in that both explore combinatorial Hilbert spaces of potentially infinite degree and thus there is need for parallelism and thus there is need for partitioning for distributed computation. (But there is no computational oracle to predict that any particular sequence of combinations of inputs under test will deterministically halt on any of the distributed workers, so second-order methods like gradient descent help to skip over apparently desolate territory when the error hasn't changed in awhile) The Fuzzing computational task: partition the set of all combinations of inputs for distributed execution with execute-once or consensus to resolve redundant results. DbC Design-By-Contract patterns include Preconditions and Postconditions (which include tests of Invariance) We test Preconditions to exclude Inputs that do not meet the specified Ranges, and we verify the Ranges of Outputs in Postconditions. We test Invariance to verify that there haven't been side-effects in other scopes; that variables and their attributes haven't changed after the function - the Command - returns. DbC: https://en.wikipedia.org/wiki/Design_by_contract : > Design by contract has its roots in work on formal verification, formal specification and Hoare logic. TLA+ > Language: https://en.wikipedia.org/wiki/TLA%2B#Language Formal verification: https://en.wikipedia.org/wiki/Formal_verification From https://news.ycombinator.com/item?id=38138319 : > Property testing: https://en.wikipedia.org/wiki/Property_testing > awesome-python-testing#property-based-testing: https://github.com/cleder/awesome-python-testing#property-ba... > Fuzzing: https://en.wikipedia.org/wiki/Fuzzing Software testing > Categorization > [..., Property testing, Metamorphic testing] https://en.wikipedia.org/wiki/Software_testing#Categorizatio... -- From https://news.ycombinator.com/item?id=28494885#28513982 : > https://github.com/dafny-lang/dafny #read-more > Dafny Cheat Sheet: https://docs.google.com/document/d/1kz5_yqzhrEyXII96eCF1YoHZ... > Looks like there's a Haskell-to-Dafny converter. haskell2dafny: https://gitlab.doc.ic.ac.uk/dcw/haskell-subset-to-dafny-tran... -- Controlled randomness: tests of randomness, random uniform not random norm, rngd, tests of randomness: From https://news.ycombinator.com/item?id=40630177 : > google/paranoid_crypto.lib.randomness_tests: https://github.com/google/paranoid_crypto/tree/main/paranoid... docs: https://github.com/google/paranoid_crypto/blob/main/docs/ran...

tool.c: https://github.com/Cisco-Talos/clamav/blob/main/sigtool/sigt... clamav sigtool: https://www.google.com/search?q=clamav+sigtool https://blog.didierstevens.com/2017/07/14/clamav-sigtool-dec... : sigtool –-find-sigs "$name" | sigtool –-decode-sigs List of file signatures: https://en.wikipedia.org/wiki/List_of_file_signatures And then also clusterfuzz/oss-fuzz scans .txt source files with (sandboxed) Static and Dynamic Analysis tools, and `debsums`/`rpm -Va` verify that files on disk have the same (GPG signed) checksums as the package they are supposed to have been installed from, and a file-based HIDS builds a database of file hashes and compares what's on disk in a later scan with what was presumed good, and ~gdesktop LLM tools scan every file, and there are extended filesystem attributes for label-based MAC systems like SELinux, oh and NTFS ADS. A sufficient cryptographic hash function yields random bits with uniform probability. DRBG Deterministic Random Bit Generators need high entropy random bits in order to continuously re-seed the RNG random number generator. Is it safe to assume that hashing (1) every file on disk, or (2) any given file on disk at random, will yield random bits with uniform probability; and (3) why Argon2 instead of e.g. only two rounds of SHA256? https://github.com/google/osv.dev/blob/master/README.md#usin... : > We provide a Go based tool that will scan your dependencies, and check them against the OSV database for known vulnerabilities via the OSV API. ... With package metadata, not (a file hash, package) database that could be generated from OSV and the actual package files instead of their manifest of already-calculated checksums. Might as well be heating a pool on the roof with all of this waste heat from hashing binaries build from code of unknown static and dynamic quality. Add'l useful formats: > Currently it is able to scan various lockfiles, debian docker containers, SPDX and CycloneDB SBOMs, and git repositories Things like bittorrent magnet URIs, Named Data Networking, and IPFS are (file-hash based) "Content addressable storage": https://en.wikipedia.org/wiki/Content-addressable_storage