From mboxrd@z Thu Jan 1 00:00:00 1970 X-Sympa-To: caml-list@inria.fr Received: from mail1-relais-roc.national.inria.fr (mail1-relais-roc.national.inria.fr [192.134.164.82]) by walapai.inria.fr (8.13.6/8.13.6) with ESMTP id q2DA4KpF015032 for ; Tue, 13 Mar 2012 11:04:23 +0100 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: AvQCAAobX0+8pSm/nGdsb2JhbABDtgIBAQEBAQgLCQkUJ4IJAQEEAThBBQsLISUPAkYGDQEHAogBBQS8fJBlBJtajH4 X-IronPort-AV: E=Sophos;i="4.73,575,1325458800"; d="scan'208";a="149035209" Received: from 12.mo3.mail-out.ovh.net (HELO mo3.mail-out.ovh.net) ([188.165.41.191]) by mail1-smtp-roc.national.inria.fr with ESMTP; 13 Mar 2012 11:04:23 +0100 Received: from mail427.ha.ovh.net (b7.ovh.net [213.186.33.57]) by mo3.mail-out.ovh.net (Postfix) with SMTP id F1C1BFF875A for ; Tue, 13 Mar 2012 10:56:22 +0100 (CET) Received: from b0.ovh.net (HELO queueout) (213.186.33.50) by b0.ovh.net with SMTP; 13 Mar 2012 11:54:47 +0200 Received: from unknown (HELO ?138.231.81.152?) (romain%bardou.fr@138.231.81.152) by ns0.ovh.net with SMTP; 13 Mar 2012 11:54:47 +0200 Message-ID: <4F5F1968.20600@lsv.ens-cachan.fr> Date: Tue, 13 Mar 2012 10:54:48 +0100 From: Romain Bardou User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.24) Gecko/20111114 Icedove/3.1.16 MIME-Version: 1.0 To: Xavier Leroy CC: caml-list@inria.fr X-Ovh-Mailout: 178.32.228.3 (mo3.mail-out.ovh.net) References: <4F3078F1.8070105@redhat.com> <4F3079F7.4040606@redhat.com> <20120207083412.GA30350@annexia.org> <20120310073113.GA16716@annexia.org> <4F5E3A6E.4010406@inria.fr> In-Reply-To: <4F5E3A6E.4010406@inria.fr> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Ovh-Tracer-Id: 1830431774597306338 X-Ovh-Remote: 138.231.81.152 () X-Ovh-Local: 213.186.33.20 (ns0.ovh.net) X-OVH-SPAMSTATE: OK X-OVH-SPAMSCORE: -100 X-OVH-SPAMCAUSE: gggruggvucftvghtrhhoucdtuddrfeegvddrfeehucetggdotefuucfrrhhofhhilhgvmecuqfggjfenuceurghilhhouhhtmecufedttdenucesvcftvggtihhpihgvnhhtshculddquddttddmnecuhfhrohhmpeftohhmrghinhcuuegrrhguohhuuceosggrrhguohhusehlshhvrdgvnhhsqdgtrggthhgrnhdrfhhrqeenucfjughrpefkfffhfgggvffufhgjtgfgsehtjegrtddtfedu X-Spam-Check: DONE|U 0.500263/N X-VR-SPAMSTATE: OK X-VR-SPAMSCORE: -100 X-VR-SPAMCAUSE: gggruggvucftvghtrhhoucdtuddrfeegvddrfeehucetggdotefuucfrrhhofhhilhgvmecuqfggjfenuceurghilhhouhhtmecufedttdenucesvcftvggtihhpihgvnhhtshculddquddttddmnecuhfhrohhmpeftohhmrghinhcuuegrrhguohhuuceosggrrhguohhusehlshhvrdgvnhhsqdgtrggthhgrnhdrfhhrqeenucfjughrpefkfffhfgggvffufhgjtgfgsehtjegrtddtfedu X-Validation-by: bardou@lsv.ens-cachan.fr Subject: Re: [Caml-list] Re: [oss-security] CVE request: Hash DoS vulnerability (ocert-2011-003) Hi, > As you and Gerd said, the new Hashtbl implementation in the upcoming > major release has everything needed to randomize hash tables by > seeding. The question at this point is whether randomization should > be the default or not: some of our big users who don't do Web stuff > value reproducibility highly... We (OCaml core developers) will take > a decision soon. FWIW, as a developer I do not expect reproducibility from Hash tables (nor from the Random module actually) but I do expect some way to control reproducibility (i.e. read the current seed, give my own seed). Maybe it's better to assume that the programmer will not be aware of attacks, and provide him with a safer environment. On the other hand, when you find a bug and need reproducibility, it's too late if you have used a random seed without recording it. And could it break some existing applications? I guess you('re) already had(having) this discussion though. Cheers, -- Romain