4 ms·
> move away from the prng included in openssl because it could have bug, could be used wrong, (...) and instead directly use the OS methods of generating random
by glandium 9y ago
> move away from the prng included in openssl because it could have bug, could be used wrong, (...) and instead directly use the OS methods of generating randomness.
This could phrased as: move away from a prng that could have bugs, could be used wrong and instead use a different prng that could have bugs and could be used wrong. And each platform would use a different prng.
Put this way, it's not really enticing.
- deleted 9y ago[deleted]
- LgWoodenBadger 9y agoIt's a move to eliminate a dependency that provides no extra security (and likely weakens security). The dependency they want to eliminate (OpenSSL) ALREADY relies on the "different prng that could have bugs and could be used wrong." The only thing they would gain is not having to handle platform-dependent issues reading from system's prng (which is only really different on Windows?).