2 ms·
Why should everyone be compromised because fuzzers want to use the simpler rand() API instead of something different? I'm not saying we shouldn't have a way to
by admax88q 6y ago
Why should everyone be compromised because fuzzers want to use the simpler rand() API instead of something different?
I'm not saying we shouldn't have a way to generate predictable "random" sequences. But the default, simple, API for random numbers in any given language should be secure.
The vast majority of software does not need pseudorandom sequences. Developers shouldn't have to think every time "is pseudorandom good enough for this use case?" It should just be strong random every time. If you need a pseudorandom we should have a separate API for that.