21–30 of 157 posts
It's open to the public‽ Seems like a bad idea to let a potential spy in there to set up a camera and de-randomize this source of random info. Also, the headline on HN declares it a fact that the lava lamps are assisting in the encryption, but the article is careful to say "maybe", "might", etc. This seems wildly insecure and much more likely to represent a weak link than to actually aid in randomness.
Even if the data is not random it doesn't weaken your kernel prng by writing non-random data to urandom. Don't overcomplicate your threat model with non-existent risks
(I don't have any problem with what CloudFlare is doing.)
Edit: While I was writing this comment, drewbug linked to the exact DJB post I was thinking of. Thanks!
I might be prejudiced, but this looks like a big PR stunt/done for the cool factor kind of thing. Aren't there simpler/saner alternatives for getting good randomness?
That said, this doubles as a public art installation in their lobby - something many companies spend thousands (or millions!) of dollars on. So it's not just PR, it's actually surprisingly practical.
I might be prejudiced, but this looks like a big PR stunt/done for the cool factor kind of thing. Aren't there simpler/saner alternatives for getting good randomness?
What would be an easier way? A wall of lava lamps seems pretty easy to set up.
I might be prejudiced, but this looks like a big PR stunt/done for the cool factor kind of thing. Aren't there simpler/saner alternatives for getting good randomness?
Probably, but it is indeed pretty cool. I appreciate when people take something potentially mundane and bring style to it.
Earlier quoted context omitted.
Even if the data is not random it doesn't weaken your kernel prng by writing non-random data to urandom. Don't overcomplicate your threat model with non-existent risks
Didn't DJB somewhere describe a PRNG model in which this is not true and you shouldn't let an adversary give you PRNG seeds? (I don't have any problem with what CloudFlare is doing.) Edit: While I was writing this comment, drewbug linked to the exact DJB post I was thinking of. Thanks!
I might be prejudiced, but this looks like a big PR stunt/done for the cool factor kind of thing. Aren't there simpler/saner alternatives for getting good randomness?
The classic HotBits ( https://www.fourmilab.ch/hotbits/ ) uses radioactive decay to get its random data. This generates 100 bytes per second of randomness. But that also depends on getting a radiation source. A single one costs about $80. A lava lamp costs $10.
Working off the list of isotopes that they provide, You've got things that have half-lives. The issue there is that the way that one generates random data from radioactivity is get an event (A), and then get another event (B) and another event (C). The time between A and B is compared to the time between B and C. If AB is shorter than CD you've got a 1. If its longer than you've got a 0. If its the same, then throw about AB. As the material decays, its rate of generating bits of data slows down.
Lava lamps are easily replaceable and don't have half-lives.
I suspect there's also issue with "here is our lead lined vault where we keep a bunch of radioactive disks to generate random data". Sure, the units are micro Curie (the most active one is a 10uCi Cesium 137). But... do you want to go into that room and change a burnt out detector? How about swapping out a lava lamp because of a burnt out bulb?