Post

This was always that one very uncomfortable concession when talking about browser fuzzing: the slowness and the practical impossibility of rewinding time, made it very impractical to do any sort of search through a state space.

Blind random walks are useful and you can definitely find bugs that you hadn't otherwise, but there's so much you're missing out on.

I had various designs where if you at least had isolation, then over time you could *maybe* get somewhere. Building up some graph or tree model of the space, balance exploration vs exploitation, etc. The catch is that the code also changes over time, which greatly complicates building useful models.