3 ms·
C has a standard library with known guarantees. Pulling the rug on those guarantees is irresponsible. The appropriate solution is to not break anything and use
by kevin_thibedeau 2y ago
C has a standard library with known guarantees. Pulling the rug on those guarantees is irresponsible.
The appropriate solution is to not break anything and use tooling that flags use of banned symbols that can have negative safety or security implications.
- kbolino 2y agoThe problem is not that OpenBSD doesn't follow the standard, it's that the standard is wrong. The default random number facility should be cryptographically secure. Most developers do not know the difference; giving them a deterministic, somewhat more performant, but completely insecure RNG by default expresses the fallacious assumption that they do. This is not the 1980s anymore, virtually every computer is connected to the Internet, there are hundreds of millions of software developers across the globe across all skill levels, and now we have them using LLMs to contend with as well, such naivete is no longer sustainable.