On Thu, May 11, 2006 at 08:49:04AM +0100, Keir Fraser wrote: > > The alternatives are unattractive: > 1. We have no good way to distinguish interrupts caused by packets > from local VMs versus packets from remote hosts. Both get muxed on the > same virtual interface. > 2. An entropy front/back is tricky -- how do we decide how much > entropy to pull from domain0? How much should domain0 be prepared to > give other domains? How easy is it to DoS domain0 by draining its > entropy pool? Yuk. IMHO there just isn't enough real entropy to go around in one physical machine without a proper HRNG. So either use urandom in all the guests or for those that really have to use /dev/random, install a hardware RNG (or wait for it :). Cheers, -- Visit Openswan at http://www.openswan.org/ Email: Herbert Xu ~{PmV>HI~} <herbert@xxxxxxxxxxxxxxxxxxx> Home Page: http://gondor.apana.org.au/~herbert/ PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
