7 ms·

I've given up on the hope that these myths will ever die. Every time it's relevant, someone pipes up complaining urandom isn't safe for use, or will run out of

I've given up on the hope that these myths will ever die. Every time it's relevant, someone pipes up complaining urandom isn't safe for use, or will run out of entropy. Have a look at the bugs for Node, Ruby and Wordpress. And inevitably, the appeal to authority ends up referring to these projects. Serious question, if I submitted a patch for the man page detailing the content of this myths page, is there a chance it might go somewhere and put somewhat of an end to some of this?

pmiller2 10y ago
Probably not. That would assume people actually read man pages.
- technion 10y ago
  For end users I would agree. However: https://bugs.ruby-lang.org/issues/9569 https://bugs.ruby-lang.org/issues/9569 I many technical discussions, the man page becomes the compelling argument.
  - asdfaoeu 10y ago
    That's a different argument. Their usage is correct and you should use a CSPRNG to generate your random data like, arc4random or the ones provided by OpenSSL.
    - technion 10y ago
      No, you should not use a userspace CSPRNG. That's the whole point.
CiPHPerCoder 10y ago
> Have a look at the bugs for Node, Ruby and Wordpress. Worth noting: WordPress has been using the OS's CSPRNG since 4.4. https://paragonie.com/blog/2015/10/coming-wordpress-4-4-csprng https://paragonie.com/blog/2015/10/coming-wordpress-4-4-cspr...
- technion 10y ago
  That's great progress! I clearly remember a lot misinformed tweets doing the rounds before you got there.
  - CiPHPerCoder 10y ago
    There's even more work to be done on the WordPress front (and PHP in general for that matter): making automatic updates secure even if the server gets hacked. https://core.trac.wordpress.org/ticket/39309 https://core.trac.wordpress.org/ticket/39309 https://github.com/paragonie/sodium_compat https://github.com/paragonie/sodium_compat I'm currently writing a pure-PHP libsodium polyfill that, once audited, will be proposed to shore up the security of PHP projects the whole world over. Among other things, this means that everyone will be able to adopt Argon2i for password hashing even if they support PHP 5.2.4 like WordPress does. Ideally, everyone would get in the habit of updating to the latest versions more rapidly. But when 27% of the Internet runs software that refuses to modernize, that becomes a huge risk to the rest of the Internet.
nshepperd 10y ago
> Serious question, if I submitted a patch for the man page detailing the content of this myths page, is there a chance it might go somewhere and put somewhat of an end to some of this? I would say go for it. It would probably make some difference (assuming the patch were accepted). People do frequently quote the man page when arguing about this issue.
Tomte 10y ago
The man pages are being worked on. At least I was CC:ed on some relevant mails in December (I think), but couldn't really follow it since I've just moved to a new apartment.
gohrt 10y ago
As long as people post articles about "myths", the myths won't die, because people will remember the myth, and forget the debunk! PLEASE: If you wanr people to remember your takeways, write TRUE statements, not False statements with debunkings!
- junke 10y ago
  That's what the Debunking Handbook advises to do too. https://www.skepticalscience.com/Debunking-Handbook-now-freely-available-download.html https://www.skepticalscience.com/Debunking-Handbook-now-free...
- dx034 10y ago
  Especially if the false statement is written in bold and the true statement is not. That could lead to remembering the myth more than the true statement, even though you know it's false.
binarycrusader 10y ago
Careful, the rules for random vs. urandom on Linux do not apply to all other NIX or NIX-like operating systems. As an example, Solaris makes them different intentionally and provides guidance on their appropriate use. I'll just point to my comments from last time: https://news.ycombinator.com/item?id=7363188 https://news.ycombinator.com/item?id=7363188 https://news.ycombinator.com/item?id=7364121 https://news.ycombinator.com/item?id=7364121
- tptacek 10y ago
  People say this every time this issue comes up with, and point to the same very long Solaris RNG blog post. But that blog post doesn't support the claim: it says that urandom and random are different on Solaris, but that urandom is a FIPS-derived DRBG running from a kernel random pool --- ie, a kernel CSPRNG, like on Linux. Can you be specific about why you believe Solaris urandom would be unsuitable for any specific cryptographic task? The fact that the "Solaris cryptographic framework team" believes something to be true is inadequate evidence for me.
  - chimeracoder 10y ago
    > Solaris cryptographic framework team" believes something to be true is inadequate evidence for me. I don't follow - why would you believe that something is secure despite the developers of it saying it is not? If you trust that they are competent, wouldn't you trust a competent cryptographer who says that their code is insecure? And if you don't trust that they are competent enough to make that evaluation, why would the assumption be that they are still somehow able to write secure code, even if they can't correctly identify it as such?
    - derefr 10y ago
      In security, competence in securing things and level of paranoia about possible threats are pretty orthogonal. Someone can be very good on a ground level when it comes to following best practices to get crypto done, while also imagining all sorts of implausible threat scenarios without thinking them fully through that make them say that what they've done is "not enough." You can find such people outside of cryptography as well: for example, the parent (or bodyguard) who won't let their child (client) leave the house because of all the deadly things that happen every day to people who leave their houses. It's what happens when you combine a profession that relies on a certain amount of healthy anxiety, with an anxiety disorder.
mkj 10y ago
They got fixed last month. http://man7.org/linux/man-pages/man7/random.7.html http://man7.org/linux/man-pages/man7/random.7.html http://man7.org/linux/man-pages/man4/random.4.html http://man7.org/linux/man-pages/man4/random.4.html https://bugzilla.kernel.org/show_bug.cgi?id=71211 https://bugzilla.kernel.org/show_bug.cgi?id=71211
- marcosdumay 10y ago
  Finally! It would be even better if there was some special file with the same semantics of getrandom, so the advise could be simply "use this file, or the getrandom syscal, whatever is easier". The way it is now, no special file is foolproof.
- schoen 10y ago
  Wow, those are big changes! I could see them having a big effect because the man page is usually the ultimate source of people's intuition that /dev/random is much safer/more appropriate for key generation. If you can just say "actually the man page no longer says that", that's pretty significant.

pmiller2 10y ago

Probably not. That would assume people actually read man pages.

technion 10y ago
For end users I would agree. However: https://bugs.ruby-lang.org/issues/9569 https://bugs.ruby-lang.org/issues/9569 I many technical discussions, the man page becomes the compelling argument.
- asdfaoeu 10y ago
  That's a different argument. Their usage is correct and you should use a CSPRNG to generate your random data like, arc4random or the ones provided by OpenSSL.
  - technion 10y ago
    No, you should not use a userspace CSPRNG. That's the whole point.

CiPHPerCoder 10y ago

> Have a look at the bugs for Node, Ruby and Wordpress. Worth noting: WordPress has been using the OS's CSPRNG since 4.4. https://paragonie.com/blog/2015/10/coming-wordpress-4-4-csprng https://paragonie.com/blog/2015/10/coming-wordpress-4-4-cspr...

technion 10y ago
That's great progress! I clearly remember a lot misinformed tweets doing the rounds before you got there.
- CiPHPerCoder 10y ago
  There's even more work to be done on the WordPress front (and PHP in general for that matter): making automatic updates secure even if the server gets hacked. https://core.trac.wordpress.org/ticket/39309 https://core.trac.wordpress.org/ticket/39309 https://github.com/paragonie/sodium_compat https://github.com/paragonie/sodium_compat I'm currently writing a pure-PHP libsodium polyfill that, once audited, will be proposed to shore up the security of PHP projects the whole world over. Among other things, this means that everyone will be able to adopt Argon2i for password hashing even if they support PHP 5.2.4 like WordPress does. Ideally, everyone would get in the habit of updating to the latest versions more rapidly. But when 27% of the Internet runs software that refuses to modernize, that becomes a huge risk to the rest of the Internet.

nshepperd 10y ago

> Serious question, if I submitted a patch for the man page detailing the content of this myths page, is there a chance it might go somewhere and put somewhat of an end to some of this? I would say go for it. It would probably make some difference (assuming the patch were accepted). People do frequently quote the man page when arguing about this issue.

Tomte 10y ago

The man pages are being worked on. At least I was CC:ed on some relevant mails in December (I think), but couldn't really follow it since I've just moved to a new apartment.

gohrt 10y ago

As long as people post articles about "myths", the myths won't die, because people will remember the myth, and forget the debunk! PLEASE: If you wanr people to remember your takeways, write TRUE statements, not False statements with debunkings!

junke 10y ago
That's what the Debunking Handbook advises to do too. https://www.skepticalscience.com/Debunking-Handbook-now-freely-available-download.html https://www.skepticalscience.com/Debunking-Handbook-now-free...
dx034 10y ago
Especially if the false statement is written in bold and the true statement is not. That could lead to remembering the myth more than the true statement, even though you know it's false.

binarycrusader 10y ago

Careful, the rules for random vs. urandom on Linux do not apply to all other NIX or NIX-like operating systems. As an example, Solaris makes them different intentionally and provides guidance on their appropriate use. I'll just point to my comments from last time: https://news.ycombinator.com/item?id=7363188 https://news.ycombinator.com/item?id=7363188 https://news.ycombinator.com/item?id=7364121 https://news.ycombinator.com/item?id=7364121

tptacek 10y ago
People say this every time this issue comes up with, and point to the same very long Solaris RNG blog post. But that blog post doesn't support the claim: it says that urandom and random are different on Solaris, but that urandom is a FIPS-derived DRBG running from a kernel random pool --- ie, a kernel CSPRNG, like on Linux. Can you be specific about why you believe Solaris urandom would be unsuitable for any specific cryptographic task? The fact that the "Solaris cryptographic framework team" believes something to be true is inadequate evidence for me.
- chimeracoder 10y ago
  > Solaris cryptographic framework team" believes something to be true is inadequate evidence for me. I don't follow - why would you believe that something is secure despite the developers of it saying it is not? If you trust that they are competent, wouldn't you trust a competent cryptographer who says that their code is insecure? And if you don't trust that they are competent enough to make that evaluation, why would the assumption be that they are still somehow able to write secure code, even if they can't correctly identify it as such?
  - derefr 10y ago
    In security, competence in securing things and level of paranoia about possible threats are pretty orthogonal. Someone can be very good on a ground level when it comes to following best practices to get crypto done, while also imagining all sorts of implausible threat scenarios without thinking them fully through that make them say that what they've done is "not enough." You can find such people outside of cryptography as well: for example, the parent (or bodyguard) who won't let their child (client) leave the house because of all the deadly things that happen every day to people who leave their houses. It's what happens when you combine a profession that relies on a certain amount of healthy anxiety, with an anxiety disorder.

mkj 10y ago

They got fixed last month. http://man7.org/linux/man-pages/man7/random.7.html http://man7.org/linux/man-pages/man7/random.7.html http://man7.org/linux/man-pages/man4/random.4.html http://man7.org/linux/man-pages/man4/random.4.html https://bugzilla.kernel.org/show_bug.cgi?id=71211 https://bugzilla.kernel.org/show_bug.cgi?id=71211

marcosdumay 10y ago
Finally! It would be even better if there was some special file with the same semantics of getrandom, so the advise could be simply "use this file, or the getrandom syscal, whatever is easier". The way it is now, no special file is foolproof.
schoen 10y ago
Wow, those are big changes! I could see them having a big effect because the man page is usually the ultimate source of people's intuition that /dev/random is much safer/more appropriate for key generation. If you can just say "actually the man page no longer says that", that's pretty significant.