1

Google offers free access to their ClusterFuzz fuzzing infrastructure (through OSS-Fuzz) to open source projects. Why does Bitcoin Core not take advantage of this?

1

The primary reason that Bitcoin Core doesn't use OSS-Fuzz is that as Greg Maxwell states in this secp256k1 issue, there is an:

extremely short timeframe mandatory disclosure (edit: 90 days) which basically made anything except blindly installed automatic updates a viable way to deploy fixes

Pieter Wuille adds some additional context here:

This extraordinary requirement for exact consistency between implementations means that these classes of issues cannot be fixed in the time scale of software releases, but requires network-wide coordination. The most relevant example is how a platform dependent deviation from the DER standard in OpenSSL threatened a network split a few years ago; you can read about the issue and its timeline here. In that case, it took 9 months between discovery and eventual resolution, but I believe that similar issues these days would take significantly longer still.

Without a future exception granted by Google, Bitcoin Core using OSS-Fuzz is a non-starter.

I am less clear on exactly how much additional value Bitcoin Core would get from using OSS-Fuzz in a theoretical world where Google granted that exception. It is partly discussed in the issue in addition to the current state of fuzzing in Core and the secp256k1 library.

There is also the consideration of dependence on a specific corporation's infrastructure. Open source projects aren't locked in to OSS-Fuzz but it is generally time consuming and disruptive to make the transition off of them.

Update on May 5th 2021: Bitcoin Core has signed up to use Google's OSS-Fuzz.

2
  • Are the things mentioned by Greg Maxwell and Pieter Wuille not valid anymore?
    – Prayank
    May 5 at 21:38
  • I enquired about this here github.com/bitcoin/bitcoin/pull/21856. I think the most important issue here is/was the disclosure requirements. There were some other minor concerns (some people don't like Google, years ago Core fuzzing was more primitive than it is now etc) but it appears that there can be exceptions on the disclosure requirements and presumably that is why people with previous concerns on disclosure requirements are happy for it to go ahead now. I cc'd Jonas, Pieter. I'm sure they would have spoken up if they still had concerns. May 6 at 9:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.