It's true that's an anti-pattern, but it's not a particularly exploitable one in... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

tptacek on July 24, 2015 | parent | context | favorite | on: A call to PHP's mt_rand generates only odd numbers

It's true that's an anti-pattern, but it's not a particularly exploitable one in most of the places that really need CSPRNGs.

paragon_init on July 24, 2015 [–]

Agreed. It's a red flag for "expect more exploitable issues to be found around the corner" and can result in biased distributions, but it by itself does not break a RNG.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact