Re: [gdm-list] Security?

["Ray Strode" <halfline gmail com>]

Hi,

> >> If it isn't clear (it seems like it's not from your responses) I'm not
> >> tied to the g_rand_* apis at all, though.  I'm in the process of
> >> rewriting the code to use /dev/urandom.
> > I just commtted this patch to subversion:
> >
> > http://www.gnome.org/~halfline/urandom.patch
>
> There is no fallback if /dev/urandom is not available?
What fallbacks guarantee enough entropy to be comparable?

- pid and current time are usually sequential and easy to guess

if a platform someone cares about doesn't support /dev/urandom we'll
have to fix GDM to use a different prescribed mechanism for that
platform.  This is where having a suitable api in glib would really
shine...

--Ray