News for hackers. Stuff that matters.
Re:Myths about /dev/urandom (2014) by vbezhenar on Saturday August 18, 2018 @08:47AM (#17788217)
In low-entropy conditions (e.g. right after OS in VM has been installed) /dev/random is better but it might block (for minutes or hours). /dev/urandom is always issues some data, so your application won't hang because of it, but it might issue not very crypto strong bytes in those conditions. Best solution is to use hardware crypto or pass random data from host to VM or something like that. Also you might consider to use getrandom syscall. It's non-blocking if entropy pool has been initialized, otherwise it blocks (AFAIK the same as FreeBSD /dev/random). Probably the best of both worlds. That's how I understand the whole topic anyway.
Re:Myths about /dev/urandom (2014) by gpvos on Saturday August 18, 2018 @08:54AM (#17788244)
> That's how I understand the whole topic anyway.

This suggests that you're not an expert. Therefore, it is wise to just stick to what the experts write, in articles such as this. That's what I do. Cryptography is a very complex subject; non-experts who give advice without knowing exactly why they are saying what they're saying are contributing to the problem, so please avoid doing that.

Re:Myths about /dev/urandom (2014) by Tomte on Saturday August 18, 2018 @09:04AM (#17788271)
Nota bene: I‘m not an expert, just quoting them. :-)

I used to be very confused, too, and after learning something about it, I wrote that page. Almost didn‘t finish and publish it when tptacek put his page up, but by that time I had already invested most of the effort, and I wanted to be less terse.

Re:Myths about /dev/urandom (2014) by gpvos on Saturday August 18, 2018 @09:23AM (#17788335)
True, maybe I should have added ...and non-experts who try to faithfully summarize them for us mere mortals.

Edit: actually, I think I would recommend everyone interested in this subject to read at least a few texts by actual experts (professors in cryptography and people who work for high-stakes security businesses), to get a taste of what it's all about.