<story><title>Secure Randomness in Go 1.22</title><url>https://go.dev/blog/chacha8rand?hn=1</url></story><parent_chain></parent_chain><comment><author>nickcw</author><text>From the article&lt;p&gt;&amp;gt; Go aims to help developers write code that is secure by default. When we observe a common mistake with security consequences, we look for ways to reduce the risk of that mistake or eliminate it entirely. In this case, math&amp;#x2F;rand’s global generator was far too predictable, leading to serious problems in a variety of contexts.&lt;p&gt;&amp;gt; For example, when Go 1.20 deprecated math&amp;#x2F;rand’s Read, we heard from developers who discovered (thanks to tooling pointing out use of deprecated functionality) they had been using it in places where crypto&amp;#x2F;rand’s Read was definitely needed, like generating key material.&lt;p&gt;I made exactly this mistake in rclone. I refactored some code which was using the Read function from crypt&amp;#x2F;rand and during the process the import got automatically changed (probably by goimports when mixing code which did use math&amp;#x2F;rand) to math&amp;#x2F;rand. So it changed from using a secure random number generator to a deterministic one rclone seeded with the time of day. I didn&amp;#x27;t notice in the diffs :-( Hence&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.cvedetails.com&amp;#x2F;cve&amp;#x2F;CVE-2020-28924&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.cvedetails.com&amp;#x2F;cve&amp;#x2F;CVE-2020-28924&amp;#x2F;&lt;/a&gt;&lt;p&gt;So this change gets a big :+1: from me.</text></comment>
<story><title>Secure Randomness in Go 1.22</title><url>https://go.dev/blog/chacha8rand?hn=1</url></story><parent_chain></parent_chain><comment><author>room271</author><text>Russell Cox consistently produces excellent technical blogs and proposals (and work). If you want to improve the clarity of your writing and thinking, he is a great place to start.</text></comment>