Re: FIX: security/samhain

2014-03-31 Thread Shawn K. Quinn
On Mon, Mar 31, 2014, at 03:14 PM, Theo de Raadt wrote: > > > I wondered about just doing $((RANDOM+RANDOM)) but don't know the > > > pros and cons of that approach - it's not exactly arc4random_uniform.. > > > > I wanted to stay in the spirit of portability. RANDOM is a ksh > > extension and dif

Re: FIX: security/samhain

2014-03-31 Thread Theo de Raadt
> > I wondered about just doing $((RANDOM+RANDOM)) but don't know the > > pros and cons of that approach - it's not exactly arc4random_uniform.. > > I wanted to stay in the spirit of portability. RANDOM is a ksh > extension and difficult to check for reliably. Well... openssl is an extension.

Re: FIX: security/samhain

2014-03-31 Thread Theo de Raadt
> On Mon, Mar 31, 2014 at 20:19, Stuart Henderson wrote: > > On 2014/03/31 20:58, Christian Weisgerber wrote: > >> security/samhain has been broken since the removal of sum(1). > >> > >> The problem is the c_random.sh script, which returns a 16-bit random > >> number in decimal. Unless I'm missin

Re: FIX: security/samhain

2014-03-31 Thread Christian Weisgerber
Stuart Henderson: > I wondered about just doing $((RANDOM+RANDOM)) but don't know the > pros and cons of that approach - it's not exactly arc4random_uniform.. I wanted to stay in the spirit of portability. RANDOM is a ksh extension and difficult to check for reliably. -- Christian "naddy" Weis

Re: FIX: security/samhain

2014-03-31 Thread Ted Unangst
On Mon, Mar 31, 2014 at 20:19, Stuart Henderson wrote: > On 2014/03/31 20:58, Christian Weisgerber wrote: >> security/samhain has been broken since the removal of sum(1). >> >> The problem is the c_random.sh script, which returns a 16-bit random >> number in decimal. Unless I'm missing something

Re: FIX: security/samhain

2014-03-31 Thread Stuart Henderson
On 2014/03/31 20:58, Christian Weisgerber wrote: > security/samhain has been broken since the removal of sum(1). > > The problem is the c_random.sh script, which returns a 16-bit random > number in decimal. Unless I'm missing something obvious, this is > surprisingly difficult to do in a semi-por

FIX: security/samhain

2014-03-31 Thread Christian Weisgerber
security/samhain has been broken since the removal of sum(1). The problem is the c_random.sh script, which returns a 16-bit random number in decimal. Unless I'm missing something obvious, this is surprisingly difficult to do in a semi-portable fashion at the shell level. I've settled on printf