hypnotoad children should srand after fork

[augensalat]

If rand() was called before fork - i.e. unnoticed by the app developer in a plugin - all children will issue the same sequence of random numbers.

Very simple example:

use Mojolicious::Lite;

my $random = rand;

get '/' => sub {
  $_[0]->stash(pid => $$, random => rand);
} => 'index';

app->start;

__DATA__

@@ index.html.ep
<%= $pid %>: <%= $random %>

Run this under hypnotoad.

As a matter of fact this is a potential security issue when generating any sort of secret tokens in a forked process.

[kraih]

This is a general Perl problem, not sure Hypnotoad should care about it. Why would you use rand() in a security feature anyway? Shouldn't you be using something like Crypt::Random instead?

[augensalat]

Then it is more a UNIX-fork-design problem rather than a Perl problem, IMHO.

rand() is crucial and I suppose many modules use it internally. There is no safe way of keeping developers from stepping into this pitfall.

[kraih]

From the rand() documentation.

"rand()" is not cryptographically secure. You should not rely
on it in security-sensitive situations. As of this writing, a
number of third-party CPAN modules offer random number
generators intended by their authors to be cryptographically
secure, including: Data::Entropy, Crypt::Random,
Math::Random::Secure, and Math::TrulyRandom.

[augensalat]

rand() can be good enough for a lot of cases.

If you don't want to fix it in Hypnotoad, what can I do to fix the problem in my app, when I want/must use rand()? Is there a way for me to call srand(), when Hypnotoad forks?

[amenonsen]

This is a general Perl problem, not sure Hypnotoad should care about it.

Agreed. And anyway, if you're generating secrets using rand(), you have
bigger problems anyway.

-- ams

[tempire]

Looks like everyone's weighed in; even me earlier, when I neglected to click the submit comment button. Trying to protect against folks ignoring the Perl docs seems like a bad road to travel.

[tempire]

Closing ticket - feel free to re-open if you have further arguments.