Viewing profile — blahrf

http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2014-2970 - seems to have been assigned April 21 - to something.. Obviously can't be LibreSSL - it didn't exist then.

CVE-2014-2970 is mentioned in the article as being assigned to the LibreSSL PRNG stuff - When I search for it to get the details it still shows as reserved. Why? The LibreSSL guys …

Ahh, not really - while the process thing the author describes is real - what you're saying is that any two processes show the same values, and that isn't the case. the bad guy nee…

Not sure how a library is going to keep a caller from closing a descriptor - I've certainly seen people attempt to close them all in code before a fork, but that's probably patholo…

Even though it looks like it won't get called, I'm wondering how bad the voodoo is? Anyone looked at what it is spitting into that hash function? How predictable are those clocks a…

"If that's the case?" - Didn't you read the code? :) Sounds like you would prefer no stirring of any new entropy after you chroot... Looks to me like they're trying to require that…

You can't simply seed it before a chroot. Look at the code. chacha adds entropy periodically and folds it in. You need entropy in the chroot. The author should probably read 10 lin…