3 ms·
The random data that was used to initalize the PRNG was removed as it was causing a linting error and only the PID was used meaning there were only 32768 (2^15)
by cwmma 11y ago
The random data that was used to initalize the PRNG was removed as it was causing a linting error and only the PID was used meaning there were only 32768 (2^15) initial states that the PRNG would be seeded with.
https://www.schneier.com/blog/archives/2008/05/random_number_b.html https://www.schneier.com/blog/archives/2008/05/random_number...
- SFjulie1 11y agoYes I remembered this one, and this resulted in the SSH keys being weakened. So ... it is the same incident. OpenBSD could forgot one day. As if 50 core devs pretending to know their jobs could do better than 10000 devs with tremenduous amounts of guidelines and administrative rules and a fair amount of political commissars. Lol. Bureaucracy will always beat amateurs.
- kryptiskt 11y agoWeakened? It meant it would only generate a couple of thousand keys, that's not weakened, that means security was killed completely. And it was in there for a couple of years. All in all a total fiasco and legendary for very good reasons. Trying to paper over it and pretending it was no big deal is the best way to ensure that similar things will happen again.