Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

well, i'm not a random number scientist or anything... but i do find it a little troubling that the random number generator at the core of linux that is trusted by everything has a secret "add more random" button on it.


Is it secret? You can just cat file.txt > /dev/random if you want to seed the generator.


can you? anyone in the village is allowed to dump old junk in there. old shoes, dead cats, kernel command lines, politician emails, old diaries and missing tax returns. and then what happens once it's in there? well, it can't really be trusted or used to actually seed the rng. half the junk in there is static. so it just kinda quietly gets mixed into the entropy hash pools... to what end exactly? it's neither ignored nor actually used in a meaningful way, so the whole problem it's trying to solve is ill-posed. this is a distinct code smell, where the problem was very hard and no good solution was found, so there are still remnants of tried and aborted approaches laying around like pieces of disused viaduct after a major earthquake. for something as critical as this, yes, i'd argue that it is indeed, sketchy.

but that's less interesting than generating entropy by exploiting the digital systems equivalent of quantum effects. which has me wondering now: what if quantum entanglement is just rowhammer for reality...


No matter what you send into the device, it can't make the output lower in quality, but it might make it better. Seems like a win-win in my books.


it's the notion, that it could make it "better", that is problematic.

does this mean that users who don't feed the pool manually have inferior keys?




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: