Bugtraq mailing list archives
Re: Tempfile vulnerabilities
From: wk () GNUPG ORG (Werner Koch)
Date: Wed, 2 Feb 2000 09:27:32 +0100
On Mon, 31 Jan 2000, Grant Taylor wrote:
open RAN, "/dev/random" || die; read(RAN,$foo,16); close RAN; $file = '/tmp/autobuse' . unpack('H16',$foo);
Please, never use /dev/random or /dev/urandom for such purposes. Aside the fact, that it does not help much in what you want to achieve it is a desaster to system performance because it empties the system's entropy pool and wastes precious entropy for unneeded things. Crypto software _really_ needs these random numbers. -- Werner Koch at guug.de www.gnupg.org keyid 621CC013 Boycott Amazon! - http://www.gnu.org/philosophy/amazon.html
Current thread:
- Re: Tempfile vulnerabilities Dug Song (Jan 31)
- <Possible follow-ups>
- Re: Tempfile vulnerabilities foo (Jan 31)
- Re: Tempfile vulnerabilities Grant Taylor (Jan 31)
- Re: Tempfile vulnerabilities Theo de Raadt (Feb 01)
- Microsoft Security Bulletin (MS00-007) Aleph One (Feb 01)
- Re: Tempfile vulnerabilities Werner Koch (Feb 02)
- Re: Tempfile vulnerabilities Theo de Raadt (Feb 02)
- Evil Cookies. Iain Wade (Feb 02)
- UPDATE: Sygate 3.11 Port 7323 Telnet Hole jalerta () nestworks com (Feb 03)
- Re: Evil Cookies. Joachim Feise (Feb 03)
- Re: Evil Cookies. Jon Paul, Nollmann (Feb 05)
- Reminder: BOF on Distributed DoS, San Jose 2/7/00 David Kennedy CISSP (Feb 06)
- Infosec.20000207.axis700.a Vitek, Ian (Feb 07)
- Re: Evil Cookies. Thomas Reinke (Feb 04)
- Re: Evil Cookies. Dylan Griffiths (Feb 07)
- 'cross site scripting' CERT advisory and MS Eric Lecht (Feb 08)