Re: [Caml-list] Re: [oss-security] CVE request: Hash DoS vulnerability (ocert-2011-003)

[Dario Teixeira <darioteixeira@yahoo.com>]

Hi,

> Basically I like the idea of "teaching" users this way. The typical user

> will understand the impact, and act accordingly. Nevertheless, I would
> like it if it would be made as easy as possible to provide good seeds if
> required. The Random module is definitely not good enough (e.g. if you
> know when the program was started like for a cgi, and the cgi reveals
> information it should better not like the pid, the Random seed is made
> from less than 10 unpredictable bits, and on some systems even 0 bits).
> 
> The ideal would be to guide the user to the decision whether protection is
> necessary, and if the answer is yes, to give the instructions how to do it
> (and provide all means for it, of course).

I think the problem may be in finding a good source of randomness that is
common across all OSes.  In Unixland this problem has largely been solved:
pretty much everyone supports /dev/random and /dev/urandom.  Windows
does things differently, however.

Cheers,
Dario Teixeira