Proposal for OSS-Fuzz executable tutorial

[bpalagi]

Assignment Proposal

Title

Integrating OSS-Fuzz into Go project to demonstrate debugging with modern fuzzing techniques

Names and KTH ID

• Brad Palagi ([email protected])
• Ben Civjan ([email protected])

Deadline

Task 1

Category

Executable Tutorial

Description

Fuzz testing is an essential topic for testing and security.

We will create a browser based jupyter-notebook with the goal of teaching the user how to effectively use OSS-Fuzz to debug a Go project.

In our tutorial we will include descriptions of what fuzzing is as a debugging technique as well as show how OSS-Fuzz can be used in practice to create a CI-based fuzz testing development cycle.

[Deee92]

Hi @bpalagi. Interesting proposal!

[monperrus]

looking forward to it!

[bencivjan]

In order to be accepted to OSS-Fuzz "an open-source project must have a significant user base and/or be critical to the global IT infrastructure". Therefore we will be using ClusterFuzzLite, a service that reuses the OSS-Fuzz toolchain but is available to closed source and smaller projects.

In addition, although we were able to get Golang working locally in a Jupyter notebook, it was significantly more difficult to install the Go kernel in a Binder instance. In order to use Binder as our cloud hosting service as was our original intention, we will switch to Python as our language of choice.

[bpalagi]

Our Final Submission can be found at #1705, as Ben commented before we did run into some areas that had to be slightly modified. The spirit of the project was not changed but ultimately Katacoda was used rather than Binder to host a browser based tutorial, as well as the language of choice was changed from Golang to Python.