On 16/03/2025 20:41, Junio C Hamano wrote: > "brian m. carlson" <sandals@xxxxxxxxxxxxxxxxxxxx> writes: > >> When arc4random was added to glibc, the Linux kernel CSPRNG maintainer >> argued that it was not a secure approach (I disagree), and convinced the >> glibc maintainers to just make it a wrapper around the Linux kernel >> CSPRNG, which it now is. So there's no actual benefit to calling >> arc4random versus getrandom, and since it's newer and less commonly >> available than getrandom, as well as slightly slower (because of an >> extra function call), getrandom should be preferred. > > This > > https://www.phoronix.com/news/GNU-Glibc-arc4random-Functions > > was the first hit of my search in the area, but I think you are > referring to > > https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=eaad4f9 > > that happened 5 days after the thing got in and the code there tells > me that your summary of the situation is quite accurate. > > So I agree that dropping this patch makes sense, but do we want to > do a bit more to improve the situation? > Yes, this patch should be dropped. (See my reply to Brian; our emails crossed!). ATB, Ramsay Jones
