News for hackers. Stuff that matters.
Re:Fixing Getrandom() by viraptor on Tuesday October 01, 2019 @04:56PM (#21130537)
They give you a VM with an image you choose. It may be an image you prepare or one they provide. But no modifications to the file contents since creation.

Drama would come from the same place as "we shouldn't trust rdrand". That's still avoiding the issue of: sometimes can't write that seed in some configurations.

Re:Fixing Getrandom() by mehrdadn on Tuesday October 01, 2019 @05:02PM (#21130597)
Yeah, so while creating it, they seed it. If you don't trust that, you install another OS yourself, with a kernel your trust, and seed it yourself when installing, from whatever sources of randomness you want. I fail to see why this wouldn't work.
Re:Fixing Getrandom() by viraptor on Tuesday October 01, 2019 @05:13PM (#21130719)
They can't seed it while creating the AMI. If they did that, everyone would share the initial seed and I could boot up the published image, run the generator with that seed, and be able to predict (for example) what ssh key your server will have.

(Or if you meant creating the VM, as explained before they can't do that for encrypted volumes for example)

Re:Fixing Getrandom() by loeg on Tuesday October 01, 2019 @05:23PM (#21130845)
If you can't trust your cloud provider to give you good boot time entropy you shouldn't host your VMs on them at all.
Re:Fixing Getrandom() by viraptor on Tuesday October 01, 2019 @05:26PM (#21130873)
Sure. Same applies to CPUs and rdrand... yet here we are.
Re:Fixing Getrandom() by loeg on Tuesday October 01, 2019 @06:12PM (#21131328)
Not all CPUs have rdrand? Yes, trust it on x86 when it is present. Otherwise... Linux runs on a lot of arch that are not x86.

I agree that the LKML fear-mongering over RDRAND is doing more harm than good.