The first issue he brings up seems legit. Whter it is exploitable or not depends heavily on if an unprivileged account can trigger a read to /dev/urandom to ab

The first issue he brings up seems legit. Whter it is exploitable or not depends heavily on if an unprivileged account can trigger a read to /dev/urandom to abort early by triggering an interrupt. I don't know Linux internals well enough to know if this is the case, but since this is documented behavior it seems reasonable to concede that there could be some platform where its true. Everything else seems specious. If you are in an environment controlled by an attacker there is no case where you can reliably generate random numbers. Sure as an attacker that already has root access I could replace /dev/urandom with a link to /dev/zero, but why would I do that when I could just install a kernel module that silently sent me whatever real random seed I decided to give you or patch your process to send the keys that are the end product of that randomness to my self?