5 ms·
Yes, there is a legitimate need, and when you know you need it, you have already demonstrated you know what you are doing, and therefore can find the proper too
by kbolino 2y ago
Yes, there is a legitimate need, and when you know you need it, you have already demonstrated you know what you are doing, and therefore can find the proper tool, even if it's not the default.
Whereas, when you don't know what you're doing, the default should not be a footgun.
- kevin_thibedeau 2y agoC has a standard library with known guarantees. Pulling the rug on those guarantees is irresponsible. The appropriate solution is to not break anything and use tooling that flags use of banned symbols that can have negative safety or security implications.
- kbolino 2y agoThe problem is not that OpenBSD doesn't follow the standard, it's that the standard is wrong. The default random number facility should be cryptographically secure. Most developers do not know the difference; giving them a deterministic, somewhat more performant, but completely insecure RNG by default expresses the fallacious assumption that they do. This is not the 1980s anymore, virtually every computer is connected to the Internet, there are hundreds of millions of software developers across the globe across all skill levels, and now we have them using LLMs to contend with as well, such naivete is no longer sustainable.