Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ruby Bug: SecureRandom should try /dev/urandom first

bugs.ruby-lang.org

Post reply on HN
Print view View original

31–40 of 138 posts

Re: Ruby Bug: SecureRandom should try /dev/urandom first

#31

Post by twr »

mintplant wrote: post #25
zaphar wrote: post #21

Earlier quoted context omitted.

would you listen to the docs or random-internet-person. I mean given that scenario as you describe it yes, obviously you go with the docs. But these aren't random-internet people. These are the acknowledged experts in the field. If you are writing crypto related code and aren't familiar with these people then there is far more wrong here than just this bug.

> these people Which people? Could you please name some of them? Honest question - the only name I can think of right now is tptacek's, but I'm sure there are more.

djb, Adam Langley, Dave Wagner, Thomas Pornin, among others.

Re: Ruby Bug: SecureRandom should try /dev/urandom first

#32

Post by viraptor »

zaphar wrote: post #21
viraptor wrote: post #13

Earlier quoted context omitted.

I have no answer to the first one. Since urandom is periodically reseeded, I believe tptacek and others - at least they provide arguments that justify their position. The other side seems to be just silent. As for "Also, why are the Ruby devs so dead set on the manual page?" - because it makes sense. If I didn't know much about random number generation, I'd rely on manuals and most widely adopted software. That means…

would you listen to the docs or random-internet-person. I mean given that scenario as you describe it yes, obviously you go with the docs. But these aren't random-internet people. These are the acknowledged experts in the field. If you are writing crypto related code and aren't familiar with these people then there is far more wrong here than just this bug.

I think the problem is that this person is not writing crypto-related code. (or they don't think they do) They write an interface to N underlying interfaces providing RNGs and don't necessarily understand how they work internally or the theory behind them. And that's kind of ok - they made it work correctly, but it could be better.

We don't expect person writing a Ruby binding for sqlite to know the theory behind database indexes and who are the acknowledged experts in that field. Yet we seem to expect that from a person writing binding for RNGs.

Re: Ruby Bug: SecureRandom should try /dev/urandom first

#33

Post by forgotpwtomain »

astrodust wrote: post #2

Is there a good random library that's not the giant ball of death that's OpenSSL?

ISAAC (http://burtleburtle.net/bob/rand/isaacafa.html) for a CSPRNG. But what is your use-case for something non-standard? Just use /dev/urandom

Re: Ruby Bug: SecureRandom should try /dev/urandom first

#34

Post by viraptor »

Freaky wrote: post #27

JRuby uses Java's java.security.SecureRandom, which (by default on OpenJDK 8) uses /dev/random, mixed with its own SHA1PRNG (this so setSeed() can be guaranteed to actually do something). Rubinius copies MRI circa 2014 via rubysl - https://github.com/rubysl/rubysl-securerandom

Does it really? From https://bugs.openjdk.java.net/browse/JDK-4705093 :

> If you call: new SecureRandom() on Linux and the default values are used, it will read from /dev/urandom and not block. (By default on Solaris, the PKCS11 SecureRandom is used, and also calls into /dev/urandom.)

Re: Ruby Bug: SecureRandom should try /dev/urandom first

#37

Post by jrochkind1 »

jasonjei wrote: post #35

[deleted/retracted]

Yes, it's just you.

The core ruby team is mostly Japanese-speaking, and Japanese developers are less likely to speak English well even than people in a lot of other countries where English is not a common first language. I think that does serve as a barrier to communication and transparency (with/towards English-speakers!). I think that's all there is, nothing "about Asian culture", or "decisions are made as a group rather than on an individual basis," or cliquishness.

We English speakers have the luxury of seeing almost all open source development happen in our first language. Most of the world doesn't. Ruby is an exception, with a mostly Japanese core team. Just how it is.

Re: Ruby Bug: SecureRandom should try /dev/urandom first

#40

Post by jasonjei »

jrochkind1 wrote: post #37
jasonjei wrote: post #35

[deleted/retracted]

Yes, it's just you. The core ruby team is mostly Japanese-speaking, and Japanese developers are less likely to speak English well even than people in a lot of other countries where English is not a common first language. I think that does serve as a barrier to communication and transparency (with/towards English-speakers!). I think that's all there is, nothing "about Asian culture", or "decisions are made as a group…

Thanks for the enlightenment, I didn't know this aspect of the Ruby core team.
Post reply on HN