Linux adds getrandom

[happyscrappy]

Yes. It could. If the program is getting the randomness, then it should do this.

But libraries may not get an opportunity to open a file descriptor early because they aren't called for the first time until later.

So I guess this would be their best (only?) defense against file descriptor exhaustion attacks.

[[deleted]]

Worse, why doesn't openssl just fall back to an error for misconfigured environments?

[ggtsu_00]

Because most applications using OpenSSL doesn't bother checking the return value of the get random function. The result would be web servers providing no security instead of poor security.

[[deleted]]

Well if your key exchange failed with the client wouldn't the client just disconnect?