Re:This shouldn't have happened: A vulnerability postmortem
by Kalium on Wednesday December 01, 2021 @09:18PM
(#29411741)
It was used as a source of randomness. Someone blindly fixing a "bug" as reported by a linter famously resulted in a major vulnerability in Debian: https://www.debian.org/security/2008/dsa-1571
[ Parent
| on HN ]
Re:This shouldn't have happened: A vulnerability postmortem
by scatters on Thursday December 02, 2021 @05:06AM
(#29414368)
This is incorrect.
If they had simply removed the offending line (or, indeed, set a preprocessor flag that was provided explicitly for that purpose) it would have been fine. The problem was that they also removed a similar looking line that was the path providing actual randomness.