Hacker News Reader

Let's assume I'm using Python 3.6. All my calls to os.urandom (such as uuid.uuid4) can block if my system's entropy goes down. Let's assume as an attacker, I can reduce the system's entropy up to making all calls to e.g. uuid.uuid4 blocking, potentially making my Python blocking everythime.

View on HN

IIUC, os.urandom(16) reads the urandom pool using getrandom() without flags. It will only block, if at all, during a short period after boot until the urandom pool is initialized. Thereafter reading from the urandom pool will never block as there's no way to drain it.

No, entropy can't "go down" and cause os.urandom to suddenly start blocking. Once it has returned a value, it will never block.

Reply on news.ycombinator.com