On 9 November 2015 14:16:56 GMT+00:00, Jonas Smedegaard <[email protected]> wrote: >Quoting Daniel Pocock (2015-11-09 14:32:51) >> As described in #770659, Chromium is having problems with the >standard >> version of libsrtp0 on jessie. > >The problem it has is that it a) rely on libSRTP to provide randomness, > >and b) block the underlying calls done internally in libSRTP to get >randomness from other sources. > >> Users have been disabling the sandbox in Chromium to work around this > >> issue, hence the security tag has been used. > >The very use of libSRTP is a security issue: libSRTP does *not* provide > >cryptographically secure randomness, and next major release of libSRTP >will _stop_ offer that unreliable randomness API. > >Therefore I believe the way forward with this is to get Chromium to get > >randomness via some other API than the bad libSRTP approach used now, >and then when that is in place try backport the proper approach to the >Chromium in Debian stable. > >I do not like to change the libSRTP code in Debian stable. The patch >itself is tiny, but just as the very Chromium issue demonstrates, can >nevertheless have big consequences. > >
The patch could be adapted so it only tries the alternative (fopen) in situations where open fails. Do you think this would reduce risk? I would prefer to see Chromium provide a more definitive solution too, but it has been like this for a long time now and because it is silently failing without explanation it is one of those things that causes user frustration and can be wrongly perceived as a Debian fault.
