Lightnews — Scholar-powered news

Reposted by Rohan Padhye

Yannic Noller @yannicnoller.bsky.social · 1d

#FUZZING'26 CALL FOR PAPERS
──────
✨ After 5 years, we will be again co-located with NDSS!

🔗 fuzzing-workshop.github.io
📅 11. Dec (Submission)

//cc @mboehme.bsky.social (MPI-SP), @ruijiemeng.bsky.social (CISPA), @rohan.padhye.org (CMU), László Szekeres (Google)

2 6

Rohan Padhye @rohan.padhye.org · 3d

Podcast! Had a fun conversation with @cachemisses.bsky.social on an episode of *Disseminate*. Check it out!

Disseminate: The Computer Science Research Podcast @disseminatepodcast.bsky.social · 3d

🚨 "Fray: An Efficient General-Purpose Concurrency JVM Testing Platform" with Rohan Padhye (@rohan.padhye.org) & Ao Li (@aoli.al) is available now!

🎙️ Guest hosted by the brilliant Bogdan Stoica (@cachemisses.bsky.social)

🎧 Listen on YouTube ➡️ youtu.be/SDaTOOEDuto?...

This Tool Finds Hidden Concurrency Bugs in Java Apps [OOPSLA 2025: Fray]

YouTube video by Disseminate: The Computer Science Research Podcast

youtu.be

3

Rohan Padhye @rohan.padhye.org · Aug 28

Excited to announce that the Fray paper has been accepted to OOPSLA'25! Work led by @aoli.al with a full pastalab.org collaboration.

📄: rohan.padhye.org/files/fray-o...
💻: github.com/cmu-pasta/fray
🎥: www.youtube.com/watch?v=AX6P...

Front page of a paper titled "Fray: An Efficient General-Purpose Concurrency Testing Platform for the JVM" by Ao Li et al. from Carnegie Mellon University.

3 4 15

Rohan Padhye @rohan.padhye.org · Aug 22

Debating whether we can add acks "We thank Reviewers A and C for their constructive feedback on our paper".

1 5

Rohan Padhye @rohan.padhye.org · Jul 14

My current conjecture is that the examples of broken JSON syntax in the paper somehow accidentally caused something like second-order prompt injection in Google Scholar's indexing pipeline. But there's only one way to find out ^^^

1 1

Rohan Padhye @rohan.padhye.org · Jul 14

Hilarious! It looks like Google Scholar is pulling citations for a different Kirschner et al. paper from 2006.

I wonder if one could use the technique proposed in "Debugging inputs" to identify what causes this anomaly. Gonna need Lukas to publish a *lot* of papers.

1 1

Reposted by Rohan Padhye

Yannic Noller @yannicnoller.bsky.social · Jun 29

🚨 Our amazing #FUZZING'25 keynotes are online!

"Constraining Fuzzing without Paying Too Much" by Miryung Kim
youtu.be/L90MBb6NLBE

"Are you sure you belong in academia?" by Will Wilson
youtu.be/qQGuQ_4V6WI

// @mboehme.bsky.social, László Szekeres, @rohan.padhye.org, @ruijiemeng.bsky.social

Marcel Böhme @mboehme.bsky.social · Jun 29

We had two exciting keynotes:
* From academia: Miryung Kim (Prof @ UCLA)
* From industry: Will Wilson (CEO and Co-Founder of @AntithesisHQ.bsky.social).
Stay tuned for recordings!

1 6 11

Rohan Padhye @rohan.padhye.org · Jun 17

The limit applies to references too? Preposterous!

1 1

Rohan Padhye @rohan.padhye.org · Jun 9

Very cool: ‪@aoli.al‬ uncovered a deadlock in OpenJDK that can be triggered with a tiny test case and Fray's deterministic concurrency testing & debugging support. Read his blog post here: aoli.al/blogs/jdk-bug/

If you write Java/Scala/Kotlin, try Fray yourself: github.com/cmu-pasta/fray

Discovering a JDK Race Condition, and Debugging it in 30 Minutes with Fray

Discovering a JDK Race Condition, and Debugging it in 30 Minutes with Fray I’ve been adding more integration tests for Fray recently. To ensure Fray can handle different scenarios, I wrote many creati...

aoli.al

3

Rohan Padhye @rohan.padhye.org · Jun 6

Just Accepted to ACM TOSEM!

The "Havoc Paradox" is about the relationship between byte-level fuzzer mutations and their effect on the inputs produced by generators for structured strings (e.g. XML/SQL). Can disruptive mutations be controlled? Should they be? Find out.

📄 dl.acm.org/doi/pdf/10.1...

2 3 21

Reposted by Rohan Padhye

Marcel Böhme @mboehme.bsky.social · May 28

🖊️ Register here: ntnu.eventsair.com/fse2025-isst...
(FUZZING is a co-located workshop)

3 5

Rohan Padhye @rohan.padhye.org · May 27

We also have an excellent program of research talks and *fuzzing nuggets*. Detailed schedule coming soon.

conf.researchr.org/home/issta-2...

List of Accepted Papers at the FUZZING Workshop

3 3

Rohan Padhye @rohan.padhye.org · May 27

We're excited to announce two keynote speakers for the #FUZZING'25 workshop (part of @issta_conf at Trondheim, Norway):

[*] Will Wilson, CEO and Co-Founder of Antithesis
[*] Miryung Kim, Professor and Vice Chair of Graduate Studies at UCLA

conf.researchr.org/home/issta-2...

1 3 8

Rohan Padhye @rohan.padhye.org · May 27

The JQF repo is now both popular enough (700+ stars) and contains enough buggy/vulnerable code as sample fuzz targets that we're getting occasionally spammed with crappy AI-generated patches.

I can't imagine what bigger OSS projects are dealing with right now.

1

Rohan Padhye @rohan.padhye.org · May 5

Congratulations!

1

Rohan Padhye @rohan.padhye.org · Apr 29

Delighted to receive an ACM SIGSOFT Distinguished Award for this work... It's about time!

Proud of the PASTA Lab students, including our visiting undergrads :-)

Rohan Padhye @rohan.padhye.org · Mar 10

Happy Daylight Savings Time to everyone in the US! A few more weeks for European Summer Time.

If you notice some of your apps glitching, don't be alarmed. Even ChatGPT can't write correct date/time code!!!

See more in our upcoming paper: rohan.padhye.org/files/dateti... (MSR'25 preprint)

Paper titled "It’s About Time: An Empirical Study of Date and
Time Bugs in Open-Source Python Software". Authors List:

Shrey Tiwari
Carnegie Mellon University
Pittsburgh, PA, USA
shrey@cmu.edu
Peter Vandervelde∗
University of California, Santa Barbara
Santa Barbara, CA, USA
pvandervelde@ucsb.edu
Serena Chen∗
University of California, San Diego
San Diego, CA, USA
sec022@ucsd.edu
Ao Li
Carnegie Mellon University
Pittsburgh, PA, USA
aoli@cmu.edu
Alexander Joukov∗
Stony Brook University
Stony Brook, NY, USA
ajoukov@cs.stonybrook.edu
Rohan Padhye
Carnegie Mellon University
Pittsburgh, PA, USA
rohanpadhye@cmu.edu

11

Rohan Padhye @rohan.padhye.org · Mar 31

Love this argument: prior work does not use our novel idea.

Text highlighted from a research paper that says "To the best of our knowledge, there is no existing search-based testing approach for productiongrade AV software, including [20], [21], [41]–[55] that: (i) uses our novel gene representation"

6

Rohan Padhye @rohan.padhye.org · Mar 20

Submission deadline for the Fuzzing workshop is tonight (AoE)! Send us those nuggets and research ideas.

Rohan

Rohan Padhye @rohan.padhye.org · Feb 17

I'm super excited about this new track at the #FUZZING'25 workshop. It's the academic version of thoughtful blog posts, but with a paper and talk for wider reach!

Submission deadline is in a month (March 20th)!

fuzzingworkshop.github.io

Marcel Böhme @mboehme.bsky.social · Feb 17

*Fuzzing nuggets* (short papers) are evidence-backed position papers or experience reports on SOTA practices---a platform for researchers & practitioners to share substantiated opinions or reflections that are of interest to the community but not to be developed into full paper.

4

Rohan Padhye @rohan.padhye.org · Mar 10

Happy Daylight Savings Time to everyone in the US! A few more weeks for European Summer Time.

If you notice some of your apps glitching, don't be alarmed. Even ChatGPT can't write correct date/time code!!!

See more in our upcoming paper: rohan.padhye.org/files/dateti... (MSR'25 preprint)

5

Rohan Padhye @rohan.padhye.org · Feb 23

It's always been a "response" for me.

The only time it was a "rebuttal" was when I explicitly thanked Reviewers A, C, and D for their valuable feedback.

1 8

Rohan Padhye @rohan.padhye.org · Feb 17

I'm super excited about this new track at the #FUZZING'25 workshop. It's the academic version of thoughtful blog posts, but with a paper and talk for wider reach!

Submission deadline is in a month (March 20th)!

fuzzingworkshop.github.io

Marcel Böhme @mboehme.bsky.social · Feb 17

*Fuzzing nuggets* (short papers) are evidence-backed position papers or experience reports on SOTA practices---a platform for researchers & practitioners to share substantiated opinions or reflections that are of interest to the community but not to be developed into full paper.

1 3 9

Reposted by Rohan Padhye

Marcel Böhme @mboehme.bsky.social · Feb 17

#FUZZING'25 CALL FOR PAPERS
──────
✨ New OC members:
* Ruijie Meng (@ruijiemeng.bsky.social; NUS)
* Rohan Padhye (@rohan.padhye.org; CMU).
✨ New paper type: Fuzzing Nuggets (short papers).

🔗 fuzzingworkshop.github.io
📅 20.March (Submission)
📅 17.April (Notification)
📅 28.June (Workshop)

1 11 18

Rohan Padhye @rohan.padhye.org · Feb 7

Back to basics: Concurrency testing in Java!

Our new tool *Fray* correctly solves a 25+ year old problem for real-world software. See this feature from Elastic Labs about Fray's contributions to Lucene.

📰: www.elastic.co/search-labs/...

🔧: github.com/cmu-pasta/fray

📝: arxiv.org/pdf/2501.12618

Blog post titled "Concurrency bugs in Lucene: How to fix optimistic concurrency failures" By Benjamin Trent and Ao Li (February 7, 2025)

Text reads: "Thanks to Fray, a deterministic concurrency testing framework from CMU’s PASTA Lab, we tracked down a tricky Lucene bug and squashed it"

2 4 20

Rohan Padhye @rohan.padhye.org · Dec 19

Cite only the paper title for now, and submit a PDF without embedded fonts. They'll probably tell you to fix it and re-submit in 48 hours. Plenty of time to get an arxiv identifier :-)

1 10

Rohan Padhye @rohan.padhye.org · Dec 13

Takeaway: Don't just fuzz and wait for bugs to show up. Measure what your inputs look like based on user-defined predicates, and things start making a lot more sense.

1 1 2