(This time in plaintext, I hope I did it right)
Hello openbsd users and developers. I read this exchange between these two
gentlemen on ports@, and I have been building a tile game where each tile is
one byte, and I want to use this function to generate a random page for the map:
int main(void) {
unsigned char page[4096];
arc4random_buf(page, sizeof(page));
return 0;
}
If you have the time for me, please read the email exchange below.
Is Theo talking about a specific function in c in this email [rand()], or
randomness in binaries in general as a concept to be avoided because it would
blow up if you tried to cat the result, or rarely spawn monkey-on-typewriter
malicious code?
On 6 October 2026 7:01:43 pm GMT-04:00, Theo de Raadt <[email protected]>
wrote:
Stuart Lamble <[email protected]> wrote:
On Wed, Oct 7, 2026, at 09:25, Theo de Raadt wrote:
warning: rand() may return deterministic values, is that what
you want?
In this day and age, wow.
It also comes out when compiling Kea. I haven’t had the time to look into it
and figure out if it’s a concern.
The existance of rand() in a binary is always a concern, unless it has been
reviewed and declared OK. It is almost never OK. Using it is never required,
those days are gone.
I think you are saying it backwards. If it exists in a binary, it is bad and
wrong.
