How do we know there isn't some predictable pattern from common urandom sources? What is meant to make the state non-predictable anyway? If I cared about it, someone could just add a library on top of it that combines them with more entropy sources. Like camera noise, temperature changes, audio static etc. For some reason the author says not to build libraries on top of urandom because they might be hacked. Well if s…
"The urandom sources"? What do you think that means? The code is right there.
I'm talking about the sources of it's random input, not it's source code.
I read it all, don't be a jerk. When you're writing a program for generic use, you can't trust the underlying system to be set up above and beyond a stock install. If you want to use seeding as a workaround, it should be done from every program that requires secure randomness. That doesn't seem to be what you're advocating. And if you're just generating a key, why not read it directly from random instead? You can pre…
Oh, we're talking past each other. Sorry. When I said "post", I meant the story this thread links to, not the comment thread. I believe you read the comments in their entirety. I think if you reread the post, you'd see that it rebuts your argument.
For encryption, the only way to be really secure is to have the same amount of randomness as there is data to encrypt, as a shared key. (A one time pad.)
This isn't that hard to do so long as you can give it to the people that need it ahead of time, and should solve all kinds of theoretical problems.
Mailing memory cards sealed in photoed glitter paint could work well too. It would be fun to 3D print a replica though.