3 ms·

A worst case example would be if the app just cycled through a fixed table of "random" choices Not even a newbie programmer is going to do this. Every language

A worst case example would be if the app just cycled through a fixed table of "random" choices Not even a newbie programmer is going to do this. Every language out there has a Random() function. Seriously, all these worst case scenarios and we're still well within the land of what even a middling iOS developer could crank out in under an hour.

xordon 11y ago
> Not even a newbie programmer is going to do this. I wouldn't bet on that. I've seen all sort of horrendous monstrosities that students and new grads have come up with.
Johnny555 11y ago
You'd be surprised what programmers will do. Sometimes due to incompetence, sometimes it's an "optimization", sometimes it's a simple mistake, yet there is some very bad code out there and it's not discovered until it causes a problem. For example, even a newbie wouldn't trust a remote client to tell you the size of a string they are sending you so you can echo it back to them, yet we still had Heartbleed and it sat there for a long time, undiscovered.
cheese1756 11y ago
Which usually isn't cryptographically secure. So now you need to audit the random number generator and make sure that it has no known holes, including obscure edge cases. And then you need to confirm that any implementation is correct and audited. That quickly takes you down a rabbit hole, which may be why the contract was so expensive.
- Karunamon 11y ago
  This is iOS we're talking about. The CSPRNG provided as part of Swift or Obj-C's standard library has likely already been audited for use on other govt. projects. http://stackoverflow.com/questions/9234686/generating-random-numbers-securely-in-objective-c http://stackoverflow.com/questions/9234686/generating-random...
  - cheese1756 11y ago
    Great point. Thanks for the link!
- imtringued 11y ago
  Oh you need a cryptographically secure RNG? Assuming the app is written for android just replace Random with SecureRandom. Here's your $100,000 invoice.

xordon 11y ago

> Not even a newbie programmer is going to do this. I wouldn't bet on that. I've seen all sort of horrendous monstrosities that students and new grads have come up with.

Johnny555 11y ago

You'd be surprised what programmers will do. Sometimes due to incompetence, sometimes it's an "optimization", sometimes it's a simple mistake, yet there is some very bad code out there and it's not discovered until it causes a problem. For example, even a newbie wouldn't trust a remote client to tell you the size of a string they are sending you so you can echo it back to them, yet we still had Heartbleed and it sat there for a long time, undiscovered.

cheese1756 11y ago

Which usually isn't cryptographically secure. So now you need to audit the random number generator and make sure that it has no known holes, including obscure edge cases. And then you need to confirm that any implementation is correct and audited. That quickly takes you down a rabbit hole, which may be why the contract was so expensive.

Karunamon 11y ago
This is iOS we're talking about. The CSPRNG provided as part of Swift or Obj-C's standard library has likely already been audited for use on other govt. projects. http://stackoverflow.com/questions/9234686/generating-random-numbers-securely-in-objective-c http://stackoverflow.com/questions/9234686/generating-random...
- cheese1756 11y ago
  Great point. Thanks for the link!
imtringued 11y ago
Oh you need a cryptographically secure RNG? Assuming the app is written for android just replace Random with SecureRandom. Here's your $100,000 invoice.