On Sun, Aug 18, 2002 at 06:59:03PM -0500, Branden Robinson wrote:
> Xdm doesn't need that much data, though (note that it only reads gobs of
> data in the #ifndef DEV_RANDOM case; in other words, when it has a
> non-entropic source). I'm tempted to have it read from /dev/random and
> get real entropy. People's X sessions need as much security as we can
> afford to give them, and helping to frustrate attacks on the
> authorization key seems a responsible thing to do.
Agreed - just wanted to make sure we're not missing anything important
here.
>
> In the long run, I'd like to solve the arch-specific /dev/mem problem as
> well, for the sake of a patch to be sent upstream for the benefit of the
> poor folks who don't have systems with a /dev/{u,}random.
I don't see any real solution to this. Since the first time I looked
into genauth.c I thought that simply reading /dev/mem is kind of broken.
-- Guido
