On 2026-10-10, Story <[email protected]> wrote: > Is Theo talking about a specific function in c in this email [rand()], or > randomness in binaries in general as a concept to be avoided because it would > blow up if you tried to cat the result, or rarely spawn monkey-on-typewriter > malicious code?
rand() normally produces a repeatable sequence of pseudo-randum numbers. Problem is many programs seed it in a predictable way (often pid, time, or a combination of the two) so at least on the same machine (and maybe externally) an observer can predict the seed + the followong sequence. On OpenBSD this has been modified so that unless deterministic results are specifically requested, higher quality non-deterministic are given. However if something in the process (including a library function) asks for deterministic numbers, that has to affect the entire process, so you still need to take care. The warning is partly because of this possibility and partly because the same code run on other OS could be predixtable. tl;dr: use one of the "arc4random" family if you want good non-deterministic random numbers (arc4random, arc4random_buf, arc4random_uniform()).
