mailing list archives
Re: Tempfile vulnerabilities
From: wk () GNUPG ORG (Werner Koch)
Date: Wed, 2 Feb 2000 09:27:32 +0100
On Mon, 31 Jan 2000, Grant Taylor wrote:
open RAN, "/dev/random" || die;
$file = '/tmp/autobuse' . unpack('H16',$foo);
Please, never use /dev/random or /dev/urandom for such purposes.
Aside the fact, that it does not help much in what you want to achieve
it is a desaster to system performance because it empties the system's
entropy pool and wastes precious entropy for unneeded things.
Crypto software _really_ needs these random numbers.
Werner Koch at guug.de www.gnupg.org keyid 621CC013
Boycott Amazon! - http://www.gnu.org/philosophy/amazon.html