[Cryptography] Use of RDRAND in Haskell's TLS RNG?

[Peter Gutmann]

Ron Garret <ron at flownet.com> writes:

>It should not matter so much that an audit has been done (though that matters
>too, of course) as that it *can* be done

Right, because Many Eyes Make Bugs Shallow, which is why there's never been
any vulns discovered in open-source software, lots of people have gone through
and audited it and found all the bugs.

>The only way to protect against this is to insist that the system be
>architected in such a way that anyone could audit it if they wanted to.

See above.  You've basically got the choice between "the code never gets
audited" (the Bystander Effect at Internet scale, I don't need to look at it
because someone else is bound to have already done so) or "the code gets
audited by someone paid or otherwise incentivised to do it", which means
you're taking someone else's word that it's OK.

Peter.