View Issue Details
| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0001816 | GNUnet | util library | public | 2011-10-03 00:08 | 2011-11-04 11:19 |
| Reporter | viric | Assigned To | |||
| Priority | low | Severity | minor | Reproducibility | always |
| Status | closed | Resolution | won't fix | ||
| Product Version | Git master | ||||
| Summary | 0001816: gnunet runs a 'find' to get randomness | ||||
| Description | I think running 'find' over the filesystems of users caring about anonimity, privacy and security sound very disturbing. Me, for example, got frightened and killed the find at once when I saw it. | ||||
| Steps To Reproduce | start gnunet for the first time | ||||
| Additional Information | There are many places where to read. The easiest, /dev/random, which linux generates through random-source events, like keystrokes or mouse movements. The audio device can be used, /dev/event/* devices, etc. In any case, gnunet should also *let know the user* what is it doing, and how. | ||||
| Tags | No tags attached. | ||||
|
|
Eh, we DO let users know (in crypto_random.c): GNUNET_log (GNUNET_ERROR_TYPE_INFO, _("Starting `%s' process to generate entropy\n"), "find"); Now, not having logging on a sufficiently high level or not reading log files is not something that is easily fixed, and this is clearly just "information", not an error (warning I might be willing to discuss). As for reading /dev/random --- what do you think we were doing to trigger the find? Reading /dev/random and being blocked by the Linux-kernel for a while! You are right that one could ask the user to type wildly on the keyboard -- but that again assumes the presence of a user reading the console and possibly of a keyboard... Finally, if you had looked at the command when you ran 'ps', you would have seen that the specific 'find' command we run is pretty harmless... |
|
|
As for using audio devices, etc, -- the Kernel already (presumably) does a good job here, so we shouldn't try to do better. Furthermore, software that takes over my microphone as an input for processing (!) is even more suspect than software that copies my files to /dev/null ;-). |
|
|
Naturally, I'm not saying we're perfect, just that the suggestions you make are not really applicable since we (techincally: libgcrypt) are reading from /dev/{s}random and the kernel already does the things you suggest we should do. |
| Date Modified | Username | Field | Change |
|---|---|---|---|
| 2011-10-03 00:08 | viric | New Issue | |
| 2011-10-03 00:16 | Christian Grothoff | Category | => util library |
| 2011-10-03 00:20 | Christian Grothoff | Note Added: 0004670 | |
| 2011-10-03 00:21 | Christian Grothoff | Note Added: 0004671 | |
| 2011-10-03 00:22 | Christian Grothoff | Note Added: 0004672 | |
| 2011-10-03 00:22 | Christian Grothoff | Assigned To | => Christian Grothoff |
| 2011-10-03 00:22 | Christian Grothoff | Status | new => feedback |
| 2011-10-04 13:47 | Christian Grothoff | Assigned To | Christian Grothoff => |
| 2011-10-04 23:18 | Christian Grothoff | Priority | normal => low |
| 2011-11-04 11:19 | Christian Grothoff | Status | feedback => closed |
| 2011-11-04 11:19 | Christian Grothoff | Resolution | open => won't fix |
