3 ms·

I guess it is really hard to write a test suite that would catch these types of weaknesses? PS Just noticed this is from 2008 (whew, I was afraid it had happen

• corresation 13y ago
  This is ancient news, and it seemed to be sufficiently explained as really silly human error. However your comment reminded me of a Dilbert- http://dilbert.com/strips/comic/2001-10-25/ http://dilbert.com/strips/comic/2001-10-25/
  • exDM69 13y ago
    While we're talking comics, this xkcd comic was inspired by this particular debian bug: http://xkcd.com/221/ http://xkcd.com/221/ As a more serious note, people who are not cryptographers should refrain from touching crypto code, especially something as important as pseudo random number generators. In addition, it's not a very good idea be doing significant modifications "downstream" from the actual project.
• mikeash 13y ago
  Stupendously hard. I mean, it wouldn't be too hard to write a test case for this one bug after you already wrote the bug and knew what you were looking for. Write a test case that runs this code multiple times and checks for duplicate outputs. If I recall the nature of this bug correctly, two runs in the same process would be enough. If not, some tens of thousands of runs would do. However, problems: A) you wouldn't know to write a test case like this until the bug happened, and B) this test won't catch similar serious bugs, such as a bug that causes the random number generator to be limited to, say, 32 bits of entropy.