cvs commit: src/games/fortune/fortune fortune.c

[Pawel Jakub Dawidek]

On Sat, Jul 23, 2005 at 11:39:34PM -0700, Colin Percival wrote:
+> Andrey A. Chernov wrote:
+> >   FreeBSD src repository
+> > 
+> >   Modified files:
+> >     games/fortune/fortune fortune.c 
+> >   Log:
+> >   My change, namely srandomdev() addition, was backed out even without
+> >   discussing with me, and I obviously disagree seeing that afterwards
+> >   (srandomdev() back out not fix any thing, it can only mask the problem).
+> >   
+> >   So, back out the back out and return srandomdev().
+> 
+> Approved by:	security-officer (cperciva)
+> 
+> Any change which helps to make a security problem obvious is a good thing, and
+> a commit which (like revision 1.28) simply hides a security problem from users
+> is Not Desired.

We should probably test entropy quality on boot.
I've somewhere userland version of /sys/dev/rndtest/ which implements
FIPS140-2 tests for (P)RNGs. We can use put it into rc.d/ and warn users.

-- 
Pawel Jakub Dawidek                       http://www.wheel.pl
pjd at FreeBSD.org                           http://www.FreeBSD.org
FreeBSD committer                         Am I Evil? Yes, I Am!
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 187 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/cvs-all/attachments/20050724/b296ff78/attachment.bin