From owner-freebsd-current@FreeBSD.ORG Sat Jul 23 19:09:38 2005 Return-Path: X-Original-To: freebsd-current@freebsd.org Delivered-To: freebsd-current@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 5707116A41F; Sat, 23 Jul 2005 19:09:38 +0000 (GMT) (envelope-from imp@bsdimp.com) Received: from harmony.village.org (vc4-2-0-87.dsl.netrack.net [199.45.160.85]) by mx1.FreeBSD.org (Postfix) with ESMTP id 033E043D45; Sat, 23 Jul 2005 19:09:37 +0000 (GMT) (envelope-from imp@bsdimp.com) Received: from localhost (localhost.village.org [127.0.0.1]) by harmony.village.org (8.13.3/8.13.3) with ESMTP id j6NJ8mIR021678; Sat, 23 Jul 2005 13:08:48 -0600 (MDT) (envelope-from imp@bsdimp.com) Date: Sat, 23 Jul 2005 13:09:41 -0600 (MDT) Message-Id: <20050723.130941.93453281.imp@bsdimp.com> To: grog@freebsd.org From: "M. Warner Losh" In-Reply-To: <20050723064449.GZ842@wantadilla.lemis.com> References: <20050723020120.GV842@wantadilla.lemis.com> <42E1DFCE.6090506@FreeBSD.org> <20050723064449.GZ842@wantadilla.lemis.com> X-Mailer: Mew version 3.3 on Emacs 21.3 / Mule 5.0 (SAKAKI) Mime-Version: 1.0 Content-Type: Text/Plain; charset=us-ascii Content-Transfer-Encoding: 7bit Cc: dougb@freebsd.org, freebsd-current@freebsd.org Subject: Re: cvs commit: src/games/fortune/fortune fortune.c X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 23 Jul 2005 19:09:38 -0000 In message: <20050723064449.GZ842@wantadilla.lemis.com> "Greg 'groggy' Lehey" writes: : You should take a look at what I committed. It simply uses the : microsecond value returned by getlocaltime() for the automatic seeding : by srandomdev(). It fixes the problem. I can see only two : explanations: : : 1. srandomdev(), random(4) or friends are broken. : 2. random(4) has been initialized incorrectly. : : Currently I'm guessing (2), but I don't care much either way. When sradnomdev() is broken, *DO*NOT* kludge around them by committing half-baked "fixes" like you did. It is broken. We need to find out the *REAL* cause of the problem. If Rush gets more quotes than normal, and that annoys people to find the real problem, we shouldn't mask it. It is a really bad choice from a security point of view. Warner