On Sat, Oct 10, 2026 at 5:22 PM Kenneth Gober <[email protected]> wrote: > > On Sat, Oct 10, 2026 at 3:20 AM Story <[email protected]> wrote: >> >> Hello openbsd users and developers. I read this exchange between these two >> gentlemen on ports@, and I have been building a tile game where each tile is >> one byte, and I want to use this function to generate a random page for the >> map: >> >> #include <stdlib.h> >> >> int main(void) { >> unsigned char page[4096]; >> arc4random_buf(page, sizeof(page)); >> return 0; >> } >> >> If you have the time for me, please read the email exchange below. >> Is Theo talking about a specific function in c in this email [rand()], or >> randomness in binaries in general as a concept to be avoided because it >> would blow up if you tried to cat the result, or rarely spawn >> monkey-on-typewriter malicious code? >> >> >> On 6 October 2026 7:01:43 pm GMT-04:00, Theo de Raadt <[email protected]> >> wrote: >>> >>> Stuart Lamble <[email protected]> wrote: >>> >>>> On Wed, Oct 7, 2026, at 09:25, Theo de Raadt wrote: >>>>> >>>>> warning: rand() may return deterministic values, is that what >>>>> you want? >>>>> >>>>> In this day and age, wow. >>>> >>>> >>>> It also comes out when compiling Kea. I haven’t had the time to look into >>>> it and figure out if it’s a concern. >>> >>> >>> The existance of rand() in a binary is always a concern, unless it has been >>> reviewed and declared OK. It is almost never OK. Using it is never >>> required, >>> those days are gone. >>> >>> I think you are saying it backwards. If it exists in a binary, it is bad >>> and >>> wrong. >>> > In this context, Theo is referring to the specific library function "rand()" > which has the property > that it may return non-random values if used improperly. Apparently there are > programs out > there that want rand(), and if it's not available from the system libraries > (or perhaps even if > it is) they include their own private copy of the function and compile it > into the program binary. > > Randomness in binaries in general is not a problem. > > -ken
Not sure what "may return deterministic values" even mean here, of course rand() will return non-random values. Every time. It's deterministic, and that's an important *feature*, not a bug. Theo knows this of course, but is perhaps a bit careless or at least talking about it in a very specific context. A random number generator that is not deterministic would be almost useless to me for most of my work. I use random numbers for testing and for monte-carlo-style simulation. There's nothing wrong with that determinism. Not every program uses random numbers for security. A game in particular would be highly advised to use a pseudo-random generator because you can keep the state in savefiles and restore the same state.
