Steve
I'm a PC, so shut up
Consultant
join:2001-03-10
Yorba Linda, CA
| reply to Cabal
Re: Heads Up: Debian OpenSSL RNG Vuln CVE-2008-0166
said by Cabal  :I know people hate to comment their code, but maybe intentionally using uninitialized memory would be a good opportunity for that sort of thing.  Funny you should mention that  |
|
Cabal
Premium
join:2007-01-21
Boston, MA
| reply to deblin
quote:
Usually it is bad to have any kind of dependency on uninitialised memory, but OpenSSL happens to include a rare case when its OK, or even a good idea: its randomness pool. Adding uninitialised memory to it can do no harm and might do some good, which is why we do it.
I know people hate to comment their code, but maybe intentionally using uninitialized memory would be a good opportunity for that sort of thing.
--
Interested in open source engine management for your Subaru? |
|
deblin
Dark Side of the Moon
Premium,MVM
join:2001-09-01
Middletown, DE
| reply to BeesTea
Thanks for the info.
Just stumbled upon this. Interesting point, not sure I entirely agree with it. But certainly in this case the author makes a good point.
--
»hillaryis404.org/ |
|
BeesTea
Network Janitor
Premium,VIP
join:2003-03-08
00000 | reply to Steve
That's the attack as I understand it exactly. Thanks! |
|
