A Tale of Four Fuzzers
Key topics
Regulars are buzzing about a blog post titled "A Tale of Four Fuzzers," with commenters diving into the nuances of random sampling versus exhaustive enumeration. Some, like pfdietz and matklad, riff on the idea that a function generating random objects can, in theory, enumerate all objects, with pfdietz arguing that random sampling simplifies this process. However, others, such as AlotOfReading, counter that exhaustive exploration is more efficient and doesn't incur logarithmic overhead. Meanwhile, a minor sidebar discussion erupts over whether the blog's CSS is broken, with captainhorst pointing out that the site's use of CSS nesting requires a relatively modern browser.
Snapshot generated from the HN discussion
Discussion Activity
Light discussionFirst comment
52m
Peak period
4
3-4h
Avg / period
1.8
Based on 16 loaded comments
Key moments
- 01Story posted
Nov 28, 2025 at 7:11 AM EST
about 1 month ago
Step 01 - 02First comment
Nov 28, 2025 at 8:03 AM EST
52m after posting
Step 02 - 03Peak activity
4 comments in 3-4h
Hottest window of the conversation
Step 03 - 04Latest activity
Nov 28, 2025 at 3:42 PM EST
about 1 month ago
Step 04
Generating AI Summary...
Analyzing up to 500 comments to identify key contributors and discussion patterns
Want the full context?
Jump to the original sources
Read the primary article or dive into the live Hacker News thread when you're ready.
More specifically: if you uniformly sample from a space of size N, then in O(N log N) tries you can expect to sample every point in the space. There's a logarithmic cost to this random sampling, but that's not too bad.
You could _implement_ non-determinism via probabilistic sampling, but you could also implement the same interface as exhaustive search.
An example is something like "pairwise testing" of arguments to a function. Just randomly generating values will hit all possible pairs of values to arguments, again with a logarithmic penalty.
What work is being offloaded from computers to people? It's exactly the same thing with more determinism and no logarithmic overhead.
Suppose that space of N points is partitioned into M relevant subsets, for now we assume of the same size. Then random sampling hits each of those subsets in O(M log M) time, even if we don't know what they are.
This sort of partitioning is long talked about in the testing literature, with the idea you should do it manually.
> what work is being offloaded
The need to write that program for explicitly enumerating the space.
https://github.com/tigerbeetle/tigerbeetle/blob/809fe06a2ffc...
then you get a random permutation. If it rather looks like this
https://github.com/tigerbeetle/tigerbeetle/blob/809fe06a2ffc...
you enumerate all permutations.
The keyword to look up more details is "coupon collector's problem".
And if you don't have time, just go to the bullet point list at the end; that's all of the best practices, and they are fantastic.
Something often forgotten here: if your PRNG only takes e.g. a 32-bit seed, you can generate at most 2^32 unique objects. Which you might chew through in seconds of fuzzing.
Edit: this is addressed later in the article/in a reference where they talk about using an exhaustive implementation of a PRNG interface. Neat!