[svn.haxx.se] · SVN Dev · SVN Users · SVN Org · TSVN Dev · TSVN Users · Subclipse Dev · Subclipse Users · this month's index

Neon and /dev/random

From: Dale Worley <dworley_at_pingtel.com>
Date: 2005-08-19 17:29:36 CEST

My apologies if this has been discussed before, but it seems to me that for
Subversion's use, Neon should be built to use /dev/urandom by default.
/dev/random is necessary if one wants cryptographic-quality random bits, but
as far as I know, Subversion's security does not depend on the
unpredictability of transaction IDs.

On the other hand, a peculiarity of /dev/random is that it extracts its
random information from hardware input events on the computer, but it does
not include disk accesses and network packets, because they are not due to
external physical systems, and might be manipulatable by other
processes/systems on the network. On a workstation, /dev/random gets all
the information it needs from the keyboard and mouse, but Neon runs on a
server, which does not get keyboard and mouse events.

The result is that it's hardly surprising that accessing /dev/random blocks
on some people's servers, and there's no reason not to use /dev/urandom.

Dale

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org
Received on Fri Aug 19 17:40:35 2005

This is an archived mail posted to the Subversion Dev mailing list.

This site is subject to the Apache Privacy Policy and the Apache Public Forum Archive Policy.