<p>The primary reason that Bitcoin Core doesn't use OSS-Fuzz is that as Greg Maxwell states in this secp256k1 <a href="https://github.com/bitcoin-core/secp256k1/issues/739#issuecomment-614348178" rel="nofollow noreferrer">issue</a>, there is an:</p>
<blockquote>
<p>extremely short timeframe mandatory disclosure (edit: <a href="https://google.github.io/oss-fuzz/getting-started/bug-disclosure-guidelines/" rel="nofollow noreferrer">90 days</a>) which basically made
anything except blindly installed automatic updates a viable way to
deploy fixes</p>
</blockquote>
<p>Pieter Wuille adds some additional context <a href="https://github.com/bitcoin-core/secp256k1/issues/739#issuecomment-614831028" rel="nofollow noreferrer">here</a>:</p>
<blockquote>
<p>This extraordinary requirement for exact consistency between implementations means that these classes of issues cannot be fixed in the time scale of software releases, but requires network-wide coordination. The most relevant example is how a platform dependent deviation from the DER standard in OpenSSL threatened a network split a few years ago; you can read about the issue and its timeline <a href="https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2015-July/009697.html" rel="nofollow noreferrer">here</a>. In that case, it took 9 months between discovery and eventual resolution, but I believe that similar issues these days would take significantly longer still.</p>
</blockquote>
<p>Without a future <a href="https://github.com/bitcoin-core/secp256k1/issues/739#issuecomment-615108330" rel="nofollow noreferrer">exception</a> granted by Google, Bitcoin Core using OSS-Fuzz is a non-starter.</p>
<p>I am less clear on exactly how much additional value Bitcoin Core would get from using OSS-Fuzz in a theoretical world where Google granted that exception. It is partly discussed in the <a href="https://github.com/bitcoin-core/secp256k1/issues/739#issuecomment-615144010" rel="nofollow noreferrer">issue</a> in addition to the current state of fuzzing in Core and the secp256k1 library.</p>
<p>There is also the consideration of dependence on a specific corporation's infrastructure. Open source projects aren't locked in to OSS-Fuzz but it is generally time consuming and disruptive to make the transition off of them.</p>
<p><strong>Update on May 5th 2021: Bitcoin Core has <a href="https://github.com/google/oss-fuzz/pull/5699" rel="nofollow noreferrer">signed up</a> to use Google's OSS-Fuzz.</strong></p>

CC BY-SA 4.0
2021-05-06T09:48:44.187Z
I enquired about this here https://github.com/bitcoin/bitcoin/pull/21856. I think the most important issue here is/was the disclosure requirements. There were some other minor concerns (some people don't like Google, years ago Core fuzzing was more primitive than it is now etc) but it appears that there can be exceptions on the disclosure requirements and presumably that is why people with previous concerns on disclosure requirements are happy for it to go ahead now. I cc'd Jonas, Pieter. I'm sure they would have spoken up if they still had concerns.
Michael Folkson
CC BY-SA 4.0
2021-01-02T17:01:09.300Z
2021-05-05T13:43:59.563Z
2021-05-05T13:43:59.563Z
Michael Folkson
<p>Google offers free access to their <a href="https://github.com/google/clusterfuzz" rel="nofollow noreferrer">ClusterFuzz</a> fuzzing infrastructure (through <a href="https://google.github.io/oss-fuzz/" rel="nofollow noreferrer">OSS-Fuzz</a>) to open source projects. Why does Bitcoin Core not take advantage of this?</p>

<bitcoin-core-development><testing><fuzz-test>
Why doesn't Bitcoin Core use Google's OSS-Fuzz?
Michael Folkson
# Why doesn't Bitcoin Core use Google's OSS-Fuzz?

(Asked by: username_0 on 2021-01-02)

Google offers free access to their [ClusterFuzz](https://github.com/google/clusterfuzz) fuzzing infrastructure (through [OSS-Fuzz](https://google.github.io/oss-fuzz/)) to open source projects. Why does Bitcoin Core not take advantage of this?

**Tags:** bitcoin-core-development, testing, fuzz-test


---

## 1 answers

### Answer by username_0 on 2021-01-02. Score: 1 | Accepted answer

The primary reason that Bitcoin Core doesn't use OSS-Fuzz is that as Greg Maxwell states in this secp256k1 [issue](https://github.com/bitcoin-core/secp256k1/issues/739#issuecomment-614348178), there is an:

> extremely short timeframe mandatory disclosure (edit: [90 days](https://google.github.io/oss-fuzz/getting-started/bug-disclosure-guidelines/)) which basically made
> anything except blindly installed automatic updates a viable way to
> deploy fixes

Pieter Wuille adds some additional context [here](https://github.com/bitcoin-core/secp256k1/issues/739#issuecomment-614831028):

> This extraordinary requirement for exact consistency between implementations means that these classes of issues cannot be fixed in the time scale of software releases, but requires network-wide coordination. The most relevant example is how a platform dependent deviation from the DER standard in OpenSSL threatened a network split a few years ago; you can read about the issue and its timeline [here](https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2015-July/009697.html). In that case, it took 9 months between discovery and eventual resolution, but I believe that similar issues these days would take significantly longer still.

Without a future [exception](https://github.com/bitcoin-core/secp256k1/issues/739#issuecomment-615108330) granted by Google, Bitcoin Core using OSS-Fuzz is a non-starter.

I am less clear on exactly how much additional value Bitcoin Core would get from using OSS-Fuzz in a theoretical world where Google granted that exception. It is partly discussed in the [issue](https://github.com/bitcoin-core/secp256k1/issues/739#issuecomment-615144010) in addition to the current state of fuzzing in Core and the secp256k1 library.

There is also the consideration of dependence on a specific corporation's infrastructure. Open source projects aren't locked in to OSS-Fuzz but it is generally time consuming and disruptive to make the transition off of them.

**Update on May 5th 2021: Bitcoin Core has [signed up](https://github.com/google/oss-fuzz/pull/5699) to use Google's OSS-Fuzz.**

> **Comments:**
> **username_0**: I enquired about this here https://github.com/bitcoin/bitcoin/pull/21856. I think the most important issue here is/was the disclosure requirements. There were some other minor concerns (some people don't like Google, years ago Core fuzzing was more primitive than it is now etc) but it appears that there can be exceptions on the disclosure requirements and presumably that is why people with previous concerns on disclosure requirements are happy for it to go ahead now. I cc'd Jonas, Pieter. I'm sure they would have spoken up if they still had concerns.  

---

