> without realising that uninitialised memory is used for randomness It was more subtle than that: there were two identical calls, one of which added uninitial

> without realising that uninitialised memory is used for randomness It was more subtle than that: there were two identical calls, one of which added uninitialized memory, while the other added real entropy. The developer mistakenly removed both, thinking both were equally useless, instead of only removing the one with undefined behavior. To make things worse, another call added the current PID, so the results weren't identical every time. See more detail at https://research.swtch.com/openssl https://research.swtch.com/openssl