I have come to realise---or rather, I have become more and more convinced that---fuzzing research has stalled not because we have no further contributions to make, but because the contributions that we are making are either incremental and merely sound impressive or presented in ways that obscure their utility. To...

Most of my comments here are US-centric, but apply to other countries I've grown up in, too. Below are some things that shouldn't need to be said, but for some reason, we do. Transgender people deserve to exist. This conquest against transgender people is merely a "common enemy" of ideologies only capable of uniting...

Previously [1, 2, 3], I've talked about the effects of what I call the "reinterpretation problem". This effect, known also as the havoc effect, is characterised by a reinterpretation of input segments as a result of a mutation. Think of a sequence of network packets, each with a length field: if you mutate one of...

Recently, I was made aware of a paper in which I was acknowledged. This came as quite a surprise; I had only spoken with this group as a single email following a post on secret.club. In essence, Leo (i.e., Ao Li from the paper) reached out as we had quite the topic collision -- the effect of mutating bytes which are...

This was a presentation offered at the Search-Based and Fuzz Testing Workshop in 2025. SBFT'25 slides provided here. Recording is available on YouTube. Abstract Following the SBFT fuzzing competition, the results were analyzed and a victor was chosen. This presentation details how we organised that competition,...

Publication is available via the IEEE publication.

Video is not available as the presentation was provided privately. Presentation slides are available on Google Slides. Some formatting is incorrect due to a change of software. Abstract The club often hears about public sector, military, and industrial offers for careers in security research. Let's talk about academia.

Publication is provided on the conference website. Source code and other artifacts available online.

This page comes about because of two things: an assignment for my computer graphics course, and a bit of inspiration from a computer graphics YouTuber, acerola, who recently did some work with fractal motion. Though the page was actually a requirement for the course, so, you tell me what inspired this page more :P...

In the past year, we've had a few discussions in my research group about joining various competitions, such as AIxCC, Pwn2Own, and others. These competitions are testing grounds for many of our research topics, as our research group primarily focuses on testing strategies for a wide variety of targets. We ultimately...

I was recently invited to speak at an automotive cybersecurity conference by Vector, a development group for cyberphysical systems1. Specifically, I was invited by Dr.rer.nat. Till Neudecker to give a talk about fuzzing as it has seemingly not seen too much uptake in the automotive industry. This will soon change...

Communication in testing topics is hard. Communicating about fuzzing in particular is hard, as it's often seen as a magical way to solve a variety of problems in testing -- it's very simple to develop, it's automated, and it has a good track record of finding bugs. But often, fuzzing can't find bugs, and when they...