I was fascinated by the link[1] in this line "As a result, instead of being hostile to fuzzing, Firefox developers actively help me fuzz their code."

It almost reads like a parody, but it's clearly quite serious; a detailed, thoughtful discussion of how you can ensure your continued ability to ship buggy products. (I know, that's not how the authors see it. But I know which philosophy I hope the people developing the software I have to use have, and it looks a lot more like Firefox than RIM.)

[1]: https://www.nccgroup.trust/uk/about-us/newsroom-and-events/b...

And in the meantime:

    Over the last 11 years, these fuzzers have found 6450 Firefox bugs,
    including 790 bugs that were rated as security-critical.

Jesse's fuzzers are wonderful. When Mozilla developers make a big change to SpiderMonkey they'll often ask the QA folks to run the change through jsfunfuzz for a few hours, and very often it'll uncover real bugs.

Very interesting. Does anyone know if V8 and derived products are regularly tested with similar tools?

V8 gets tested on clusterfuzz

Best name ever!

Yes, this is now common practice for all browser vendors, AFAIK.

The same tools, if they want. jsfunfuzz has been privately available to other browser vendors for some time (although possibly not the latest version?).

I worked with Jesse a few years ago doing penetration testing on Firefox. He always amazed me with his brilliance. I learned a lot from his work, and he's a really nice person as well.

Jesse's "stir DOM" fuzzer, which fits in a tweet & a bookmarklet:

    pick = a => a[a.length * Math.random() | 0];
    elts = document.all;
    stir = () => pick(elts).appendChild(pick(elts));
    setInterval(stir, 1);

Fun background information: https://twitter.com/jruderman/status/626381997850632192

Honest q: what is meant by "modern Firefox"?

FF 39-42, as opposed to say, FF 4.

OK, thanks. And is that because of a large architectural difference starting around v39, compared to earlier versions?

Yes. Over the years we have worked on projects that would reduce the impact of bugs found by this fuzzer. For example we have prevented whole classes of security bugs that this fuzzer would find, which would reduce the priority of fixing them compared to a benign crash.