Re: [Caml-list] Re: [oss-security] CVE request: Hash DoS vulnerability (ocert-2011-003)

[Romain Bardou <bardou@lsv.ens-cachan.fr>]

Hi,

> As you and Gerd said, the new Hashtbl implementation in the upcoming
> major release has everything needed to randomize hash tables by
> seeding.  The question at this point is whether randomization should
> be the default or not: some of our big users who don't do Web stuff
> value reproducibility highly...  We (OCaml core developers) will take
> a decision soon.

FWIW, as a developer I do not expect reproducibility from Hash tables 
(nor from the Random module actually) but I do expect some way to 
control reproducibility (i.e. read the current seed, give my own seed). 
Maybe it's better to assume that the programmer will not be aware of 
attacks, and provide him with a safer environment.

On the other hand, when you find a bug and need reproducibility, it's 
too late if you have used a random seed without recording it. And could 
it break some existing applications?

I guess you('re) already had(having) this discussion though.

Cheers,

-- 
Romain