Re: maradns reproducibility fixes and the merits of picking a random number

[Brian Cully]

> > The upstream website says: "People like MaraDNS because it’s ...
> > remarkably secure." [1] Since many distributions have the same 
> > issue,
> > upstream could perhaps offer the patch as a build switch to 
> > enable a
> > build-time seed only when needed.
>
> Sounds like the safest option. Maybe we could change the code 
> that uses that number to naise an exception or abort?

This seems like the best option to me, as well: either add a flag 
to explicitly enable embedding a constant, or remove the code 
entirely and replace it with a build failure (or runtime failure, 
if a build failure is not possible). It seems like a mis-feature 
to me to embed a constant seed, and invites silent 
misconfiguration which will lead to security breaches.

-bjc