/*
 * Version B of the C password example: the obvious fix, still not secure.
 *
 * Companion to "LLMs Can Write Code, but Cannot Read Your Mind"
 * https://hed.am/briefs/llms-can-write-code-but-cannot-read-your-mind/
 *
 *   cc -O2 -Wall -Wextra -o password-srand password-srand.c
 *   ./password-srand
 *   ./password-srand       # different password now
 *
 * Seeding from the clock removes the repetition, which is the part you can
 * see. Two problems survive the repair. The seed is a timestamp in whole
 * seconds, so an attacker who knows which day a password was generated has
 * 86,400 seeds to search, and one who knows the minute has 60. Separately,
 * rand() is not a cryptographic generator at any seed: its internal state can
 * be recovered from its output, which is a documented property of the
 * function rather than a quirk of one implementation (CWE-338).
 *
 * The remedy is a different generator rather than a better seed: getentropy()
 * or arc4random_uniform() in C, secrets in Python. See password-secrets.py.
 */

// Version B - the obvious fix, and still not secure
#include <stdio.h>
#include <stdlib.h>
#include <time.h>

#define PASSWORD_LENGTH 16
#define CHARSET "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789"

int main(void) {
    const char charset[] = CHARSET;
    const int charset_size = sizeof(charset) - 1; // exclude null terminator

    srand((unsigned) time(NULL));

    for (int i = 0; i < PASSWORD_LENGTH; i++) {
        int index = rand() % charset_size;
        putchar(charset[index]);
    }

    putchar('\n');

    return 0;
}