Yes, you need to fuzz your code, but that's not a simple process; you need to give fuzzers very complicated information about the possible problem input for your program. And there is no reason to think that your team is better at searching for vulnerabilities than a malware team; you're in a race.
Just like valgrind and compiler warnings fuzzying is only useful in decreasing the probability of unsafe memory access. It does so at a cost and still does not solve the fundamental problem.
Comments
There's just a timeout on replies that grows with depth.
Why not fuzz your own code then?
Got it, thanks, though I need to be going anyway.
Yes, you need to fuzz your code, but that's not a simple process; you need to give fuzzers very complicated information about the possible problem input for your program. And there is no reason to think that your team is better at searching for vulnerabilities than a malware team; you're in a race.
Just like valgrind and compiler warnings fuzzying is only useful in decreasing the probability of unsafe memory access. It does so at a cost and still does not solve the fundamental problem.