Re: ssh, /dev/urandom

[tb@becket.net (Thomas Bushnell, BSG)]

"Alfred M. Szmidt" <ams@kemisten.nu> writes:

>    > I think that we can all accept that there are currently a variety of
>    > security holes in the Hurd.  The type of security holes which would be
>    > introduced by using bad random data, however, is far worse as it has
>    > the potential to allow an attacker to obtain access to systems that
>    > are ssh'ed to from the Hurd.
> 
>    Really?  So you think that using telnet to get to those systems will
>    be more secure?
> 
> More secure in the sense that the user knows that it has no security,
> which the user does not know if she uses Open SSH + crappy random
> bits.

This is, as I already have said multiple times, an excellent reason
for full and clear documentation.  It is not a reason for excluding
the program.