From owner-freebsd-current Sun Feb 2 16:26:43 2003 Delivered-To: freebsd-current@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id AD92637B401 for ; Sun, 2 Feb 2003 16:26:41 -0800 (PST) Received: from a.smtp.serv.lythe.org.uk (pc4-oxfd1-6-cust225.oxfd.cable.ntl.com [62.254.141.225]) by mx1.FreeBSD.org (Postfix) with ESMTP id 4170243F79 for ; Sun, 2 Feb 2003 16:26:40 -0800 (PST) (envelope-from ejb@insolence.lythe.org.uk) Received: from insolence.lythe.org.uk (ejb@localhost [IPv6:::1]) by a.smtp.serv.lythe.org.uk (8.12.6/8.12.6) with ESMTP id h130QX1a005836; Mon, 3 Feb 2003 00:26:33 GMT (envelope-from ejb@insolence.lythe.org.uk) Received: from localhost (localhost [[UNIX: localhost]]) by insolence.lythe.org.uk (8.12.6/8.12.6/Submit) id h130QXcS005835; Mon, 3 Feb 2003 00:26:33 GMT (envelope-from ejb) From: Edward Brocklesby To: Don , current@FreeBSD.ORG Subject: Re: rand() is broken Date: Mon, 3 Feb 2003 00:26:33 +0000 User-Agent: KMail/1.5 References: <200302021848.NAA19508@agamemnon.cnchost.com> <200302030007.01718.ejb@lythe.org.uk> <20030202190827.K2458@calis.blacksun.org> In-Reply-To: <20030202190827.K2458@calis.blacksun.org> MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit Content-Disposition: inline Message-Id: <200302030026.33781.ejb@lythe.org.uk> Sender: owner-freebsd-current@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG On Monday 03 February 2003 12:18 am, Don wrote: > It isn't a question of the API. It's a question of expected function > output. Then it's applicable not only to binary packages as Terry states, but any source that uses rand(). > I run FreeBSD and not Linux because of the stability and predictability of > the system. Changing a critical function like rand() when we know that > there are applications which depend on its output I would say that depending on the internal algorithm used by rand() (or random()) is a bad idea; however, I don't know what the relevant standards say about this, so I won't say any further. (Why is it a bad idea? Because I'm not going to write software which makes this assumption; I'm sure that even if at some point in time all systems use an identical algorithm, at some point my software will have to run on a system which uses something different. So if I really need it, I will take rand() from libc and place it in my own code.) > does not seem like a good idea. > > A seperate function for those who need cryptographic randomness seems like > a _much_ better idea. I'm not sure Yet Another RNG API (of course arc4random() already exists) gains anything unless rand()/random() absolutely cannot be changed; and as I say I'm not convinced this is the case. Doesn't even the 0 / RAND_MAX fix change the algorithm? Software which relies on that behaviour will break .. > This is my person opinion. I am not a developer so please take my comments > as such. Likewise. Regards, Edward. To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-current" in the body of the message