<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
Can someone summarize what happened?<br>
<br>
SecureRandom used to get entropy from /dev/random, which is
configurable through a policy file to /dev/urandom. Has this
changed?<br>
<br>
Alex<br>
<br>
<div class="moz-cite-prefix">On 12/07/2014 00:33, Martin Buchholz
wrote:<br>
</div>
<blockquote
cite="mid:CA+kOe09ZJiZ9u4SnDkcoAiFGi2Roa3sOMtR+FEXkWhUAwvEwjg@mail.gmail.com"
type="cite">
<div dir="ltr">
<div class="gmail_extra">Thanks to Peter for digging into the
secure seed generator classes and coming up with a patch.
Openjdk security folks, please review. I confess to getting
lost whenever I try to orient myself in the twisty maze of
seed generator implementation files.</div>
<div class="gmail_extra"><br>
</div>
<div class="gmail_extra">Anyways, it seems important to have
prngs like ThreadLocalRandom be able to get a few bits of seed
entropy without loading hundreds of classes and without
occupying any file descriptors permanently. Perhaps at Google
we will go back to writing some simple non-portable startup
code to read /dev/urandom until openjdk security team comes up
with a more principled solution (but one that doesn't drag in
too much machinery).</div>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
Concurrency-interest mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Concurrency-interest@cs.oswego.edu">Concurrency-interest@cs.oswego.edu</a>
<a class="moz-txt-link-freetext" href="http://cs.oswego.edu/mailman/listinfo/concurrency-interest">http://cs.oswego.edu/mailman/listinfo/concurrency-interest</a>
</pre>
</blockquote>
<br>
</body>
</html>