David Chisnall (*Now with 50% more sarcasm!*) on Nostr: The thing I wish someone would build, which I suspect would find bugs a lot more ...

The thing I wish someone would build, which I suspect would find bugs a lot more cheaply than Claude Mythos:

Integrate a static analyser with a fuzzer.

Static analysers will find paths and variable values that, if they occur, reach unhappy states in the program. But they can’t tell you that it is possible for the preconditions to occur.

Fuzzers can explore the state space of code rapidly by throwing random values at it and then refining the input to try to explore specific places in the state space.

I would love to see someone wire up clang’s analyser with libFuzzer, for example, so that you can throw the analyser at a big project and have it spit out the hooks for guided fuzzing, then try to generate the inputs that will trigger the possible bug. Bonus points if it then tries to minimise the test case (some existing fuzzers do this).

This would then give you a fully automated way of triaging static analysis reports, by providing something you can use as a test case for the ones that are easy to trigger.