On: Arc4random – randomization for all occasions

[edwintorok]

Shouldn't glibc provide an arc4random? Apparently the new syscall is not for direct use [1], and you might not want to link with LibreSSL just to get arc4random [2]

[1] http://www.openbsd.org/papers/hackfest2014-arc4random/mgp000... [2] http://www.openbsd.org/papers/hackfest2014-arc4random/mgp000...

[justincormack → edwintorok]

There is a proposal to make a Posix interface that is essentially similar.[1]

[1] http://austingroupbugs.net/view.php?id=859

[tedunangst → justincormack]

And now I have more work to do... :)

[joehillen → tedunangst]

So is this going in? Are you using arc4random()?

[tedunangst → joehillen]

That's certainly possible. I don't control what goes where, I only made the proposal.

[throwaway2048 → edwintorok]

The chances of glibc importing openbsd derived functions are practically nil unfortunately, as we saw with the strlcat saga. With the departure of Drepper, things might have changed, but strlcat is still not imported.

[justincormack → throwaway2048]

Things have changed enormously since Drepper left. It is a nice project to work with and many things that were vetoed are getting in.

[fafner → throwaway2048]

I don't think that's true. Drepper was against strlcat for specific reasons. And in the meanwhile the C11 standard had adopted an alternative (but imo worse) API for it, based on the Microsoft stuff.

Framing this as a general rejection of APIs because they are from OpenBSD is highly disingenuous.

[sarciszewski → throwaway2048]

What is the reason for that? :(

[IvyMike → sarciszewski]

Drepper's caustic style aside, his point ultimately was that truncation is still a problem. Whether or not you think glibc should include strlcat, this is an important point to understand.

More discussion here: http://stackoverflow.com/q/2114896/67591

[tedunangst → IvyMike]

Note that you can mechanically translate strcat(dst, src) to strlcat(dst, src, SIZE_MAX) with no loss of functionality or change in behavior. No worries about truncation, either. Exactly the same thing.

Now, if reading a piece of code that does strlcat(dst, src, SIZE_MAX) would make you feel uncomfortable, the question is how should you feel reading code that uses strcat?

[pdw → sarciszewski]

Not specified in any standard, not much of an improvement according to the glibc maintainers, and already provided in libbsd.

[edwintorok → pdw]

Speaking of libbsd it should be updated to use ChaCha20 too: https://bugs.freedesktop.org/show_bug.cgi?id=85827