new | show | ask | jobs Github

NooneAtAll3 42 minutes ago

> but what if there’s a bug in the kernel which causes /dev/(u)ramdom to be less than secure?

so instead you suggest trusting your own untested unlooked at implementation more?

▲

strenholme 34 minutes ago | parent | next [-]

Black-and-white thinking like this is always inaccurate.

>untested

The automated tests includes tests that make sure the XOF is correctly implemented. [1]

>unlooked at

People have been looking at my code for security holes for well over 20 years, and I have been getting multiple AI assisted security reports over the last year, things like “there’s a buffer overflow in this code which is nay to impossible to exploit, using code which hasn’t even been able to compile since 2022”.

[1] https://github.com/samboy/MaraDNS/tree/master/deadwood-githu... and https://github.com/samboy/MaraDNS/tree/master/deadwood-githu...

	▲	SideQuark 3 minutes ago \| parent [-]
		XOF correctly implemented doesn’t ensure you haven’t made other mistakes, such as using entropy sources correctly, doing needed math correctly to avoid any entropy bias, etc. etc…. You’re correct about black and white thinking. Then you invoke multiple straw men in this thread to defend that you’ll roll your own. Disclaimer: I’ve been hired for multiple DoD projects to break hardware and software security systems, and I nearly always succeed, because so many people (and companies) roll their own.

▲

UnlockedSecrets 36 minutes ago | parent | prev [-]

No you see what we do, Is we ask Claude to make no mistakes in implementing the CSPRNG. This way we ensure there are no mistakes in the implementation or mathematics.

https://xkcd.com/221/