Is this just for PR/show and the real entropy generator is standardized across sites to be something boring in some back room? Or if a terrorist came in and cut power to a chaos wall would it really cause an extended outage?
What I love about this, the lava lamp wall in San Francisco, and the double pendulums in London, is that it takes something very abstract and makes it tangible for our team and our customers.
Another much smaller pendulum in the hands-on science exhibits, you scooped sand into it and then set it swinging freely across a square black surface. It would trace out amazing patterns as it spilled sand hourglass-style.
So then some bully would rock up next to me and smack the pendulum, stop it from swinging, and spill a big blob on the formerly-geometric pattern. And they invariably said "just to see what would happen". AStonesThrow would have a small meltdown or become rather indigant. I suppose their empirical science is just as valid as kicking down sandcastles on the beach.
And that's how I came to prefer single-player games...
https://en.wikipedia.org/wiki/Lissajous_curve
The sand pendulum drew lissajous curves as it swung. [I learned it today because they called the ESA Gaia probe's orbit "Lissajous" around the Lagrange point.]
https://www.esa.int/Enabling_Support/Operations/Farewell_Gai...
I used to think the same but here's a counter-example of a (hypothetical) attack based on a malicious entropy source being able to manipulate the hash/PRNG output:
https://blog.cr.yp.to/20140205-entropy.html
Now, it's not necessarily the most likely attack to materialize, as already pointed out downthread: https://news.ycombinator.com/item?id=43391377.
Prevents not only technical issues but attacks like someone blocking the camera or putting a static photo in front of the camera.
Now I wonder about some periodic offsets. E.g. if the lights are off at night, or if the skies are overcast in winter, does it skew the results in some significant way. I seriously doubt that though.
This is why, in an app, you might seed with timestamp and process ID and /dev/urandom, in case any of them happen to be non-unique or unsupported.
Though this is certainly a pretty expensive if nice looking backup entropy source.
It all nets out to "these are fine blog posts; don't try it at home".
That's an interesting way of saying "if the wall loses power". Your name wouldn't be Hans Gruber, would it?
Crystals are generally considered pretty orderly, yet the oversaturated solution actually gains entropy when it crystallizes.
There's a SF story to be had here: the global superintelligence uses bits of litter and fallen leaves and stuff to generate unbreakable encryption; the terrorists wage a global campaign to clean up litter, prune trees, get everything neat and orderly in order to hack the system...
There is also dedicated "TRNG" hardware which will measure random thermal noise. Some will even get fancy with quantum effects.
Any source of randomness will do, you just feed it into a hash function and extract uniform randomness you can use in cryptography.
For example, if you have an image sensor that takes an image (and does no post-processing) and you feed that image into SHA256 you get 256 bits which you can use for cryptography. As long as the image is never saved there is no practical way to recreate the input and in fact the input will contain more entropy (degrees of freedom) than the output, so no one would even want to try. Most of the degrees of freedom in the image would come from sensor noise and not the scene, so you don't even need to take off the cap from the camera.
In practice, multiple sources are combined. The Linux kernel does this for /dev/[u]random though it doesn't use the camera. There is a potential risk with such combination: one of the inputs may come from a source which is able to interrogate all the other sources, it would then be able to adversarially choose its contribution to skew RNG results. This is a somewhat obscure and unlikely threat model.
There has to be some code that already does that.
It doesn't really go bad unless you disseminate the material to inappropriate parties. You could store terabytes of it in S3 buckets for an emergency.