I wonder whether a tool as unexpectedly successful as this presents the security community with a weird dilemma: If so many people have begun to use afl-fuzz, find problems, and report them, can't we expect that just as many people find problems and don't report them?
Now, my security expertise goes as far as "don't roll your own", so maybe all the bugs found were, in practice, relatively difficult to exploit. But could afl-fuzz have helped scores of blackhatters to find and abuse the next shellshocks? If so, in hindsight, was it actually a good move to release afl-fuzz so openly and enthusiastically?
There's scores of Linux distributions dedicated to bundling as many security-related scripts as possible. If we're going to be talking about "utility to blackhatters", there's plenty of tools that have been around for longer and have been far more influential.
SELECT n()AND+#0;
SELECT strftime()
DETACH(SELECT group_concat(q));
DROP TABLE IF EXISTS t0; CREATE TABLE t0(t);
INSERT INTO t0 SELECT strftime();
SELECT quote(t) FROM t0
Not to mention his insane CNC and robotics work. And that is just a freaking hobby to him.