The upstream website says: "People like MaraDNS because it’s ...
remarkably secure." [1] Since many distributions have the same
issue,
upstream could perhaps offer the patch as a build switch to
enable a
build-time seed only when needed.
Sounds like the safest option. Maybe we could change the code
that uses that number to naise an exception or abort?
This seems like the best option to me, as well: either add a flag
to explicitly enable embedding a constant, or remove the code
entirely and replace it with a build failure (or runtime failure,
if a build failure is not possible). It seems like a mis-feature
to me to embed a constant seed, and invites silent
misconfiguration which will lead to security breaches.
-bjc
