On Sat, Oct 10, 2026 at 3:20 AM Story <[email protected]> wrote:
> Hello openbsd users and developers. I read this exchange between these two
> gentlemen on ports@, and I have been building a tile game where each tile
> is one byte, and I want to use this function to generate a random page for
> the map:
>
> #include <stdlib.h>
>
> int main(void) {
> unsigned char page[4096];
> arc4random_buf(page, sizeof(page));
> return 0;
> }
>
> If you have the time for me, please read the email exchange below.
> Is Theo talking about a specific function in c in this email [rand()], or
> randomness in binaries in general as a concept to be avoided because it
> would blow up if you tried to cat the result, or rarely spawn
> monkey-on-typewriter malicious code?
>
>
> On 6 October 2026 7:01:43 pm GMT-04:00, Theo de Raadt <[email protected]>
> wrote:
>
>> Stuart Lamble <[email protected]> wrote:
>>
>> On Wed, Oct 7, 2026, at 09:25, Theo de Raadt wrote:
>>>
>>>> warning: rand() may return deterministic values, is that what
>>>> you want?
>>>>
>>>> In this day and age, wow.
>>>>
>>>
>>> It also comes out when compiling Kea. I haven’t had the time to look into
>>> it and figure out if it’s a concern.
>>>
>>
>> The existance of rand() in a binary is always a concern, unless it has been
>> reviewed and declared OK. It is almost never OK. Using it is never
>> required,
>> those days are gone.
>>
>> I think you are saying it backwards. If it exists in a binary, it is bad and
>> wrong.
>>
>> In this context, Theo is referring to the specific library function
"rand()" which has the property
that it may return non-random values if used improperly. Apparently there
are programs out
there that want rand(), and if it's not available from the system libraries
(or perhaps even if
it is) they include their own private copy of the function and compile it
into the program binary.
Randomness in binaries in general is not a problem.
-ken
