From: Stuart Henderson <stu@spacehopper.org>
Subject: Re: [Maintainer Update] archivers/zpaqfranz-65.8
To: Theo de Raadt <deraadt@openbsd.org>
Cc: Stuart Lamble <openbsd@stuart.lamble.id.au>, tux0r <tux0r@rosaelefanten.org>, "ports@openbsd.org" <ports@openbsd.org>
Date: Sat, 10 Oct 2026 12:18:10 +0100

On 2026/10/06 17:01, Theo de Raadt wrote:
> Stuart Lamble <openbsd@stuart.lamble.id.au> wrote:
> 
> > On Wed, Oct 7, 2026, at 09:25, Theo de Raadt wrote:
> > > warning: rand() may return deterministic values, is that what
> > >    you want?
> > >
> > > In this day and age, wow.
> > 
> > It also comes out when compiling Kea. I haven’t had the time to look into it and figure out if it’s a concern.
> 
> The existance of rand() in a binary is always a concern, unless it has been
> reviewed and declared OK.  It is almost never OK.  Using it is never required,
> those days are gone.
> 
> I think you are saying it backwards.  If it exists in a binary, it is bad and
> wrong.
> 

This is only in a benchmark tool (perfdhcp), not part of the main
program. Predictability is not really a concern there afaik.
Looks like modulo bias though.


    /// \brief Returns random relay address.
    ///
    /// \return single string containing relay address.
    std::string getRandRelayAddr() { return relay_addr_list_[rand() % relay_addr_list_.size()]; }



    /// \brief Returns random packet from the storage.
    ///
    /// This function picks random packet from the storage and returns
    /// it. It is way slower than the @c getNext function because it has to
    /// iterate over all existing entries from the beginning of the storage
    /// to the random packet's position. Therefore, care should be taken
    /// when using this function to access elements when storage is large.
    ///
    /// \return random packet from the storage.
    PacketPtr getRandom() {
        if (empty()) {
            return (PacketPtr());
        }
        current_pointer_ = storage_.begin();
        if (size() > 1) {
            std::advance(current_pointer_, rand() % (size() - 1));
        }
        PacketPtr packet = *current_pointer_;
        current_pointer_ = storage_.erase(current_pointer_);
        return (packet);
    }