3 ms·
Of course. I proposed a theoretical way to abuse a hypothetical RNG prediction (if any were possible). Whether or not it's exploitable is, frankly, far above m
by sarciszewski 12y ago
Of course.
I proposed a theoretical way to abuse a hypothetical RNG prediction (if any were possible). Whether or not it's exploitable is, frankly, far above my understanding or pay grade. Whether it's exploitable today, versus whether it will be exploitable 10 years from now are even harder to say. If any advancements are made that cause the existing wp_rand() to become more fragile, it will probably be people far more intelligent than I am that will think of it.
(Disclaimer: Considering I don't and probably never will get paid for any of the bugs/patches I submit to open source projects, that pay grade is effectively $0.)
I'm only interested in seeing it fixed rather than proving that it can be pwned. Getting a CVE and then posting to FD were just steps I took because it appeared that I was being ignored. I now know that it wasn't intentional.