News for hackers. Stuff that matters.
[deleted]
Re:Random Numbers by tptacek on Monday June 07, 2010 @03:27PM (#1411546)
The only conclusion you can draw from Reddit is that his pictures would be less interesting if you use mt_rand() instead of rand(). mt_rand() is still insecure.

Since published research on RNGs seems to severely lag research on block ciphers and even hash functions, it seems like a really bad idea to build anything that needs to be safe on an RNG that was never designed to be secure.

Re:Random Numbers by ktsmith on Monday June 07, 2010 @04:03PM (#1411702)
I certainly wasn't trying to debate the value of mt_rand or it's implementation of the Mersenne Twister. I was simply trying to point out this is an extremely old issue, and that the problem specified in the article (a visible problem with rand()) is removed by using mt_rand(). Also, the issue only occurs due to problems with the PRNG on Windows specifically and was not present on other operating systems. The use of php's rand() or mt_rand() for applications that require security seems to be outside the scope of the article as it was presented since the author didn't necessarily understand the topic as can be seen by his proposed solutions.
Re:Random Numbers by tptacek on Monday June 07, 2010 @04:10PM (#1411725)
You managed to point out how extremely old this issue was in a manner that implied that mt_rand() was safe for use for security. Since this is an extremely, extremely common problem in PHP code, your comment did more harm than good.
Re:Random Numbers by ktsmith on Monday June 07, 2010 @04:39PM (#1411830)
Since you feel it was so harmful I've removed it.
Re:Random Numbers by someone_here on Monday June 07, 2010 @03:28PM (#1411547)
This was discussed here too, but I think it's an interesting article so I re-submitted it.
Re:Random Numbers by ktsmith on Monday June 07, 2010 @03:53PM (#1411656)
My complaint had more to do with the fact that the article contains no date information than the fact it was resubmitted. Since it contains no date information someone that is seeing it for the first time might think this was a brand new issue and no one was aware of the problem.