BeesTea
Network Janitor
Premium,VIP
join:2003-03-08
00000 | Re: Heads Up: Debian OpenSSL RNG Vuln CVE-2008-0166 That's the attack as I understand it exactly. Thanks! | |
|
 
deblin
Dark Side of the Moon
Premium,MVM
join:2001-09-01
Middletown, DE
| Re: Heads Up: Debian OpenSSL RNG Vuln CVE-2008-0166 Thanks for the info.
Just stumbled upon this. Interesting point, not sure I entirely agree with it. But certainly in this case the author makes a good point. 
--
»hillaryis404.org/ | |
|
 | 
Cabal
Premium
join:2007-01-21
Boston, MA
| Re: Heads Up: Debian OpenSSL RNG Vuln CVE-2008-0166 quote:
Usually it is bad to have any kind of dependency on uninitialised memory, but OpenSSL happens to include a rare case when its OK, or even a good idea: its randomness pool. Adding uninitialised memory to it can do no harm and might do some good, which is why we do it.
I know people hate to comment their code, but maybe intentionally using uninitialized memory would be a good opportunity for that sort of thing. 
--
Interested in open source engine management for your Subaru? | |
|
| | 
Steve
I'm a PC, so shut up
Consultant
join:2001-03-10
Yorba Linda, CA
| Re: Heads Up: Debian OpenSSL RNG Vuln CVE-2008-0166 said by Cabal  :I know people hate to comment their code, but maybe intentionally using uninitialized memory would be a good opportunity for that sort of thing. Funny you should mention that | |
|
|
|
|
