lwIP - A Lightweight TCP/IP stack - Bugs: bug #64010, oss-fuzz integration
You are not allowed to post comments on this tracker with your current authentication level.
bug #64010: oss-fuzz integration
Submitter: | J. Neuschäfer <jne> | ||
Submitted: | Thu 06 Apr 2023 03:25:39 PM UTC | ||
Category: | Security-related | Severity: | 3 - Normal |
Item Group: | None | Status: | None |
Privacy: | Public | Assigned to: | None |
Open/Closed: | Open | Planned Release: | None |
lwIP version: | git head |
Jump to the original submission
Tue 18 Apr 2023 11:21:23 AM UTC, comment #14: |
Ineiev <ineiev> |
Fri 14 Apr 2023 06:11:13 PM UTC, comment #13: To come back to this issue from a project leader point of view, I'm now not sure what to say.
|
Simon Goldschmidt <goldsimon>![]() |
Fri 14 Apr 2023 08:29:53 AM UTC, comment #12:
|
Ineiev <ineiev> |
Thu 13 Apr 2023 10:14:01 AM UTC, comment #11:
|
Jan Breuer <jan_breuer> |
Thu 13 Apr 2023 08:10:09 AM UTC, comment #10:
|
Ineiev <ineiev> |
Tue 11 Apr 2023 08:28:31 AM UTC, comment #9: According to the requirements [1], the use of non-free software is prohibited. Even just talking about it here is forbidden.
|
Jan Breuer <jan_breuer> |
Sat 08 Apr 2023 06:12:16 PM UTC, comment #8: Thanks for reading the article.
|
Ineiev <ineiev> |
Sat 08 Apr 2023 05:42:04 PM UTC, comment #7: Or, to take the "Service as a Software Substitute" phrase literally:
|
J. Neuschäfer <jne> |
Sat 08 Apr 2023 05:28:29 PM UTC, comment #6: It is true, OSS-Fuzz is SaaS (and inconveniently requires using a Google account), and thus may be undesirable for some people.
|
J. Neuschäfer <jne> |
Sat 08 Apr 2023 03:23:16 PM UTC, comment #5: Unless I'm mistaken, OSS-Fuzz is a Service as a Software Substitute. SaaSS takes away even more computing freedom than proprietary software, we urge people to avoid such services. |
Ineiev <ineiev> |
Sat 08 Apr 2023 02:36:31 PM UTC, comment #4: Regarding the specific burdens you are concerned about:
|
J. Neuschäfer <jne> |
Fri 07 Apr 2023 08:21:35 PM UTC, comment #3: As long as that doesn't put any burden on us (e.g. fix the reported bug in a specific timeframe, report anything back, etc.), I would be fine with that. We do have fuzzing, only we don't have the computing power to extensively run it... |
Simon Goldschmidt <goldsimon>![]() |
Fri 07 Apr 2023 02:04:24 PM UTC, comment #2: The main thing in the reports is a testcase file, i.e. an input to lwip_fuzz{,2,3}. This should be enough to fully reproduce the bug.
|
J. Neuschäfer <jne> |
Fri 07 Apr 2023 08:39:39 AM UTC, comment #1: One important detail I have experience from other projects:
|
Stian Sebastian Skjelstad <mywave> |
Thu 06 Apr 2023 03:25:39 PM UTC, original submission:
Google runs a service called oss-fuzz (https://github.com/google/oss-fuzz/), which offers hosted fuzzing for Free / Open Source Software projects.
|
J. Neuschäfer <jne> |
No files currently attached
Depends on the following items: None found
Items that depend on this one: None found
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
"BSD" is ambiguous: multiple software licenses have "BSD" in their name; all widely-known ones are free software licenses, but some of them are GPL-incompatible, therefore unacceptable for Savannah.
Definitely not; if the GNU Project thought so, we wouldn't list permissive licenses in our registration form.
As I said in comment #10, mirroring a repository isn't a SaaSS; even if it's problematic on GitHub, the problems are different.
It depends on what your CI does. SaaSS, like proprietary software, primarily harms its users, so "bad" isn't the most exact word. However, I think you shouldn't use Savannah to direct other people to such things.