We can't change history, only improve the future. There are three levels of defense, precisely because until now there's been no way to robustly detect a fork()

We can't change history, only improve the future. There are three levels of defense, precisely because until now there's been no way to robustly detect a fork(), but it will be nice to nail that for 4.14 and beyond and fleets can move surprisingly quickly to newer kernel versions and get the benefit of that. I think we have a high bar for a code readability and that the code isn't screaming goto fail. Though we do hate ifdef's and goto's and that file is one of the few places we have any, again precisely because of the ickyness of the challenge prior to 4.14. But if it helps reassure you, we also have a test case to make sure that the fork detection works: https://github.com/awslabs/s2n/blob/master/tests/unit/s2n_random_test.c https://github.com/awslabs/s2n/blob/master/tests/unit/s2n_ra... The test checks that a child and a parent really do produce different random streams.