Herold Heiko <[EMAIL PROTECTED]> writes:
> Resubmit as attachment since my previous posts wrapped. Applies to
> 1.8-beta3 .
Thanks. I've applied this, because it's a good stop-gap solution.
But I still have some remarks...
* We're now using lrand48 on Unix and RAND_screen on Windows. This
looks completely wrong because we're not checking for lrand48 at
all, and it could be missing. Also, RAND_screen might be useless on
Windows if you're running Wget from a batch job. So, two things:
+ Switch to rand() for a random value. It's less secure, but as
Daniel explained, anyone who cares about security will not use
an RNG to seed another RNG. This will make Wget compile on
Windows and MacOS X.
+ If possible, use rand() in addition to RAND_screen, in case
RAND_screen is useless. This is optional.
+ Implement a `--random-file' option for people who do care about
security, but cannot or don't want to use /dev/random or EGD.
I'm not sure if Christian has time for this, so I might take a
stab at it before 1.8. One problem is that I'm a cryptography
dummy. "The problem with bad cryptography is that it looks just
like good cryptography" and all that.
