A Tale of Four Fuzzers

https://tigerbeetle.com/blog/2025-11-28-tale-of-four-fuzzers/

79•jorangreef•2mo ago

Comments

pfdietz•2mo ago

> If you wrote a function that takes a PRNG and generates a random object, you already have a function capable of enumerating all objects.

More specifically: if you uniformly sample from a space of size N, then in O(N log N) tries you can expect to sample every point in the space. There's a logarithmic cost to this random sampling, but that's not too bad.

matklad•2mo ago

It is much better than this. You can _directly_ enumerate all the objects, without any probabilities involved. There's nothing about probabilities in the interface of a PRNG, it's just non-determinism!

You could _implement_ non-determinism via probabilistic sampling, but you could also implement the same interface as exhaustive search.

pfdietz•2mo ago

Well, yes. But the point is that random sampling lets you do it without thinking. Even better, it can sample over multiple spaces at the same time, and over spaces we haven't even yet formalized. "Civilization advances by extending the number of important operations which we can perform without thinking of them." (Whitehead)

An example is something like "pairwise testing" of arguments to a function. Just randomly generating values will hit all possible pairs of values to arguments, again with a logarithmic penalty.

AlotOfReading•2mo ago

The point is that you can exhaustively explore the space without logarithmic overhead. There's no benefits to doing it with random sampling and it doesn't even save thought.

pfdietz•2mo ago

I already explained what the benefit is. What is it with this focus on offloading work from computers to people? Let people do things more easily without thinking, even if it burns more increasingly cheap cycles.

AlotOfReading•2mo ago

You haven't explained what the benefit is. There aren't "spaces we haven't formalized" because of the pigeonhole principle. There are M bits. You can generate every one of those 2^M values with any max cycle permutation.

What work is being offloaded from computers to people? It's exactly the same thing with more determinism and no logarithmic overhead.

pfdietz•2mo ago

> There aren't any "spaces we haven't formalized"

Suppose that space of N points is partitioned into M relevant subsets, for now we assume of the same size. Then random sampling hits each of those subsets in O(M log M) time, even if we don't know what they are.

This sort of partitioning is long talked about in the testing literature, with the idea you should do it manually.

> what work is being offloaded

The need to write that program for explicitly enumerating the space.

matklad•2mo ago

Just to avoid potential confusion, the claim is that this is a function that generates a random permutation:

    pub fn shuffle(g: *Gen, T: type, slice: []T) void {
        if (slice.len <= 1) return;

        for (0..slice.len - 1) |i| {
            const j = g.range_inclusive(u64, i, slice.len - 1);
            std.mem.swap(T, &slice[i], &slice[j]);
        }
    }

And this is a function that enumerates all permutations, in order, exactly once:

    pub fn shuffle(g: *Gen, T: type, slice: []T) void {
        if (slice.len <= 1) return;

        for (0..slice.len - 1) |i| {
            const j = g.range_inclusive(u64, i, slice.len - 1);
            std.mem.swap(T, &slice[i], &slice[j]);
        }
    }

Yes, they are exactly the same function. What matters is Gen. If it looks like this

https://github.com/tigerbeetle/tigerbeetle/blob/809fe06a2ffc...

then you get a random permutation. If it rather looks like this

https://github.com/tigerbeetle/tigerbeetle/blob/809fe06a2ffc...

you enumerate all permutations.

AlotOfReading•2mo ago

What's being suggested also has the m log m partition behavior in the limit where N >> M. It might be easier to see why these are actually the same things with slightly different limits, imagine a huge N enumerated by an LFSR. We'll call our enumeration function rand() for tradition's sake. Now we're back to sampling.

IngoBlechschmid•2mo ago

Just a tiny addition: Yes, N log N is the average time, but the distribution is heavily long-tailed, the variance is quite high, so in many instances it might take quite some time till every item has been visited (in contrast to merely most items).

The keyword to look up more details is "coupon collector's problem".

pfdietz•2mo ago

You can also cover every one of the points "with high probability" in O(N log N) time (meaning: the chance you missed any point is at most 1/p(N) for a polynomial p, with the constant in the big-O depending on p.)

efilife•2mo ago

is the css completely fucked or am I the only one?

philipwhiuk•2mo ago

seems fine

captainhorst•2mo ago

The site uses CSS nesting which requires a browser with baseline 2023 support.

atn34•2mo ago

> If you wrote a function that takes a PRNG and generates a random object, you already have a function capable of enumerating all objects.

Something often forgotten here: if your PRNG only takes e.g. a 32-bit seed, you can generate at most 2^32 unique objects. Which you might chew through in seconds of fuzzing.

Edit: this is addressed later in the article/in a reference where they talk about using an exhaustive implementation of a PRNG interface. Neat!

gavinhoward•2mo ago

The title of the blog post downplays the absolute masterclass that this post is. It should be called "A Tale of Four Fuzzers: Best Practices for Advanced Fuzzing."

And if you don't have time, just go to the bullet point list at the end; that's all of the best practices, and they are fantastic.

OpenCiv3: Open-source, cross-platform reimagining of Civilization III

The Waymo World Model

Monty: A minimal, secure Python interpreter written in Rust for use by AI

Show HN: Look Ma, No Linux: Shell, App Installer, Vi, Cc on ESP32-S3 / BreezyBox

Show HN: I spent 4 years building a UI design tool with only the features I use

Dark Alley Mathematics

Microsoft open-sources LiteBox, a security-focused library OS

Sheldon Brown's Bicycle Technical Info

Show HN: If you lose your memory, how to regain access to your computer?

Hackers (1995) Animated Experience

An Update on Heroku

Show HN: R3forth, a ColorForth-inspired language with a tiny VM

I spent 5 years in DevOps – Solutions engineering gave me what I was missing

A century of hair samples proves leaded gas ban worked

How to effectively write quality code with AI

Learning from context is harder than we thought

FORTH? Really!?

Understanding Neural Network, Visually

PC Floppy Copy Protection: Vault Prolok

I now assume that all ads on Apple news are scams

The Oklahoma Architect Who Turned Kitsch into Art

I'm going to cure my girlfriend's brain tumor

Show HN: Smooth CLI – Token-efficient browser for AI agents

Claude Composer

Evaluating and mitigating the growing risk of LLM-discovered 0-days

Show HN: Slack CLI for Agents

How virtual textures work

Introducing the Developer Knowledge API and MCP Server

Evolution of car door handles over the decades

Why I Joined OpenAI

OpenCiv3: Open-source, cross-platform reimagining of Civilization III

The Waymo World Model

Monty: A minimal, secure Python interpreter written in Rust for use by AI

Show HN: Look Ma, No Linux: Shell, App Installer, Vi, Cc on ESP32-S3 / BreezyBox

Show HN: I spent 4 years building a UI design tool with only the features I use

Dark Alley Mathematics

Microsoft open-sources LiteBox, a security-focused library OS

Sheldon Brown's Bicycle Technical Info

Show HN: If you lose your memory, how to regain access to your computer?

Hackers (1995) Animated Experience

An Update on Heroku

Show HN: R3forth, a ColorForth-inspired language with a tiny VM

I spent 5 years in DevOps – Solutions engineering gave me what I was missing

A century of hair samples proves leaded gas ban worked

How to effectively write quality code with AI

Learning from context is harder than we thought

FORTH? Really!?

Understanding Neural Network, Visually

PC Floppy Copy Protection: Vault Prolok

I now assume that all ads on Apple news are scams

The Oklahoma Architect Who Turned Kitsch into Art

I'm going to cure my girlfriend's brain tumor

Show HN: Smooth CLI – Token-efficient browser for AI agents

Claude Composer

Evaluating and mitigating the growing risk of LLM-discovered 0-days

Show HN: Slack CLI for Agents

How virtual textures work

Introducing the Developer Knowledge API and MCP Server

Evolution of car door handles over the decades

Why I Joined OpenAI

A Tale of Four Fuzzers

Comments