8 pointsby wh33zle6 hours ago1 comment
  • mabliang5 hours ago
    Does coverage guidance actually help much here, or does most of the value come from having a good generator and reference model?
    • wh33zle5 hours ago
      Coverage is just the feedback loop. If you don't have a good generator, feedback that certain areas are uncovered doesn't really help. But without coverage, the generator doesn't really explore deeper states.

      Under the hood, the fuzzer actually works with _features_, not source code coverage and there are ways in explicitly giving the fuzzer additional feedback. Some early data suggests that this is very effevtive.