top | item 43775727

(no title)

bennettnate5 | 10 months ago

> All engineers used fuzzing to test for panic safety, and as a result, no Rust implementation has a red mark.

I'm curious how they decided whether an implementation had a vulnerability. Did they use formal methods to test for the absence of panics (maybe something like Kani)? Or was it manual code inspection and/or fuzzing? If the latter, this comparison is unfair in that the developers got to test their code on its evaluation criteria before it was evaluated and correct their mistakes (similar to training an ML model on the test set).

discuss

order

No comments yet.