Re: [gentoo-hardened] Running short of entropy...

[Ed W]

> I'm not sure exactly how ssp is implemented in a nuts and bolts sort of
> way. However, I would say lowering the quality of the random data used
> for the canary would be a bad idea. It could allow someone to more
> easily compromise a system protected by ssp.


There's no doubt that it lowers security, but I think even if you just 
picked a fixed canary value per system (say 42) then it already means 
that most buffer overflow attacks still fail..

Agreed that someone specifically targeting you will get in, but I'm far 
more worried about the general class of attacks... SSP is just one more 
layer of security, not the only layer

Cheers

Ed W