[ILUG] serious Debian/Ubuntu security hole found

[Michael Watterson]

Timothy Murphy wrote:
> On Friday 16 May 2008 03:29:28 pm paul at clubi.ie wrote:
>
>   
>>> This is pure wishful thinking. You are saying that if _you_ cannot
>>> work out what the next number is, because the system is so
>>> complicated, then the sequence must be random.
>>>
>>> You are much, much better off with a mathematical function f(n) mod
>>> m which people have studied, and found no patterns in the output.
>>>       
>> So an RNG based on study and understanding of the physical world is
>> "wishful thinking", but based on periodic functions, that's fine.
>> (RANDU?).
>>
>> This sounds like domain snobbery to me. ;)
>>     
>
> f(n) mod m is not necessarily (or even usually) periodic.
>
> Anybody who pays real money for a black box
> that is supposed to output random numbers through quantum theory
> is very gullible, in my view.
>
> It is one thing to understand quantum mechanics,
> and quite another to construct a device that uses it.
>
> You might as well say that if you understand thermodynamics
> you can construct an efficient car engine.
>
> Ps Do you know about quantum entanglement?
>
>
>   
You don't need to know anything about quantum mechanics to make a USB 
key with zener and ADC in it. You can read it for the next 10,000,0000 
years (at 1G samples / sec) and never see a pattern nor predict what the 
next number will be. Does it matter how often you read it? Think of a 
dice thrown continuously.  It  doesn't  make any difference when you 
look or how often you look, it has no memory. The odds of a six on any 
one throw are 1/6th. But you can never know what a previous or later 
throw is without actually viewing the event.

"White Noise" is a bit of  red herring. All thermal  noise sources have 
a  curved  frequency  distribution like a  skewed  bell.  The  curve  
peak  moves  with temperature  (observable by  varying voltage on a  
filament bulb.). This does not make the signal less random. In fact we 
don't much care about the frequency distribution.

This is far off the original topic. But interesting. Also interesting is 
that Humans have no instinct about probability. What seems reasonable is 
usually wrong. Betting on a lottery number that has come up or hasn't 
come up (or roulette numbers) makes no practical difference. A random 
walk can be very very long. But since there is always a bias in favour 
of casino ( the number you can't bet on) and the lottery a percentage is 
kept, the gamblers are the losers. The balls, wheel, dice have no memory.


 

-- 
Mike