Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Hear me out, I think in its deprecated-but-not-removed state it is actually more dangerous.

Projects who have been seeding the random generator like they should suddenly think “oh I don’t need to do that anymore” and get rid of their manual seeding.

Then a compromised or rogue library decides to seed the global generator themselves to a hard coded value in an `init()`, thus meaning merely importing the library re-statics the seed.

It would look pretty innocuous and non-obvious in code AND be potentially pretty difficult to notice it happening in a lot of use cases. For bonus points/making it slightly harder to detect points they could even have a random set of seeds they use.

The right answer, probably just generally anyway, is to never use the global generator, and always create your own instance. Global state is a danger once again



I think that's an interesting case, but any program where the random numbers have security implications should already be using crypto/rand, and not math/rand anyway.


Do we know if the Seed function is now noop or does it set the seed value like previous?

I don't think people would use the "global" random functions for deterministic randomness. At least I hope they didn't...


It does set the seed value like previous. The docs says calling Seed(1) forces the old behavior. https://pkg.go.dev/math/rand#Seed


I agree that would be a rough situation, but why would a library ever do that in the first place?


E.g. a supply chain attack.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: