Hello openbsd users and developers. I read this exchange between these two
gentlemen on ports@, and I have been building a tile game where each tile is
one byte, and I want to use this function to generate a random page for the map:
#include <stdlib.h>
int main(void) {
unsigned char page[4096];
arc4random_buf(page, sizeof(page));
return 0;
}
If you have the time for me, please read the email exchange below.
Is Theo talking about a specific function in c in this email [rand()], or
randomness in binaries in general as a concept to be avoided because it would
blow up if you tried to cat the result, or rarely spawn monkey-on-typewriter
malicious code?
On 6 October 2026 7:01:43 pm GMT-04:00, Theo de Raadt <[email protected]>
wrote:
>Stuart Lamble <[email protected]> wrote:
>
>> On Wed, Oct 7, 2026, at 09:25, Theo de Raadt wrote:
>> > warning: rand() may return deterministic values, is that what
>> > you want?
>> >
>> > In this day and age, wow.
>>
>> It also comes out when compiling Kea. I haven’t had the time to look into it
>> and figure out if it’s a concern.
>
>The existance of rand() in a binary is always a concern, unless it has been
>reviewed and declared OK. It is almost never OK. Using it is never required,
>those days are gone.
>
>I think you are saying it backwards. If it exists in a binary, it is bad and
>wrong.
>
