Skip to content

Conversation

@WeidiDeng
Copy link
Member

Similar to 7413.

Copy link
Member

@mholt mholt left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks Weidi! I just noticed one thing I wanted to check on.

key := fmt.Sprintf("rw_test_%d", weakrand.Int())
contents := make([]byte, 1024*10) // size sufficient for one or two ACME resources
_, err := weakrand.Read(contents)
_, err := rand.Read(contents)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
_, err := rand.Read(contents)
_, err := weakrand.Read(contents)

Should be weakrand, right?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this supposed to be cryptographically secure? math/rand/v2 doesn't have a package level 'Read' but it's easy to fill the content using random number generators.

"errors"
"fmt"
"math/rand"
"math/rand/v2"
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I wonder if we should import this as weakrand for consistency with other files. It's a convention that helps ensure readers know the package is not strong enough for cryptographic use. But then again I guess linters do this too, so I dunno.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants