TIL busybox generates password salts from current time in usec. Does this matter? Probably not, but seems mildly sus.
12
11
123
Conversation
Replying to
I expect BusyBox machines have very little entropy from attached hardware, etc., possibly not enough for standard syscalls? But yeah, still sus
2
4
No, the kernel CSPRNG works properly everywhere on modern Linux kernels. Software should only have a fallback code path for legacy kernels if at all. Should never be doing things wrong as the first choice regardless.
What’s “modern”? Plenty of microcontrollers don’t go past 2.6…
1
Oldest Linux kernel branch that's still supported is Linux 4.4 and it will be dropped soon.
A new LTS is added every year and they receive 6 years of support. Products with a longer lifetime are expected to move to new LTS branches. Most projects shouldn't support older kernels.
1
2
Show replies