Hacker News Reader

Comment by mpyne | Hacker News Reader

The interaction between OpenSSH portable and LibreSSL portable is especially amusing.

The current source for OpenSSH no longer requires linking to (Open|Libre)SSL http://undeadly.org/cgi?action=article&sid=20140430045723

It sounds like there should be something like a libopenbsdcompat containing arc4random et al., which both these packages would then import+depend on.

There's libbsd for Linux, although I can't comment on the quality of its implementation.

libbsd and gnulib are pretty much just functions copy-pasted out of their original locations into conveniently organized repositories. There's not much to speak of concerning implementation quality.

Now that the glibc leadership changes have taken place, hopefully we can see functions like arc4random, explicit_bzero, timingsafe_bcmp, reallocarray and the other stuff actually appear in glibc where they belong, so no glue will be required.

They are pretty damn useful when you're trying to do secure programming.

(Of course, arc4random should use ChaCha20.)

the function name is arc4random but it's chacha20 http://marc.info/?l=openbsd-cvs&m=138065251627052&w=2

Indeed, that's my point: don't forget that the name is legacy and slightly misleading.

RC4 is about to get another public result against it, btw.

I think there recently was a proposal for reallocarray in glibc. Not sure what happened to it though.

Reply on news.ycombinator.com