Ruby Bug: SecureRandom should try /dev/urandom first
bugs.ruby-lang.org
Ruby Bug: SecureRandom should try /dev/urandom first
1–10 of 138 posts
Re: Ruby Bug: SecureRandom should try /dev/urandom first
#2Is there a good random library that's not the giant ball of death that's OpenSSL?
Re: Ruby Bug: SecureRandom should try /dev/urandom first
#3Is there a good random library that's not the giant ball of death that's OpenSSL?
Depends on why you want to use a random number generating library. What are your requirements and specifically what are your requirements that aren't satisfied with the system's csprng. Once you have that defined, you can start looking at what algorithms you want and from there what libraries implement it.
Edit: or to put another way, first define what is it that linux's getrandom() and /dev/urandom doesn't provide you.
Re: Ruby Bug: SecureRandom should try /dev/urandom first
#4So once again, the man page for urandom creates more problems than solutions. (https://bugzilla.kernel.org/show_bug.cgi?id=71211)
Re: Ruby Bug: SecureRandom should try /dev/urandom first
#5You know your language is bad when PHP -- possibly the most hated web scripting language on the planet -- does it better.
Come on Ruby, get your act together. You can do better, right?
Re: Ruby Bug: SecureRandom should try /dev/urandom first
#6Is there a good random library that's not the giant ball of death that's OpenSSL?
I've used Mersenne Twister[0] in the past.
[0] http://www.math.sci.hiroshima-u.ac.jp/~m-mat/MT/emt.html
If you're talking about an RNG library for cryptographic purposes, then it depends on your use case.
Re: Ruby Bug: SecureRandom should try /dev/urandom first
#7Is there a good random library that's not the giant ball of death that's OpenSSL?
I've used Mersenne Twister[0] in the past. [0] http://www.math.sci.hiroshima-u.ac.jp/~m-mat/MT/emt.html If you're talking about an RNG library for cryptographic purposes, then it depends on your use case.
That one needs manual seeding too, which may lead to more issues.
Re: Ruby Bug: SecureRandom should try /dev/urandom first
#8Is there a good random library that's not the giant ball of death that's OpenSSL?
Depends on why you want to use a random number generating library. What are your requirements and specifically what are your requirements that aren't satisfied with the system's csprng. Once you have that defined, you can start looking at what algorithms you want and from there what libraries implement it. Edit: or to put another way, first define what is it that linux's getrandom() and /dev/urandom doesn't provide y…
This talk about C++ and rand being harmful is quite educational: https://channel9.msdn.com/Events/GoingNative/2013/rand-Consi...
What it points out is that even a good random number generator can be used incorrectly, and without the right tools your efforts to produce truly random numbers are doomed from the start.
C++ has an embarrassing wealth of random number generators. The Ruby core has almost nothing that can measure up to that, yet it seems like a huge oversight.
I like that C++ has a generator for many different use cases, they all have their reason for being there, but Ruby has a singular one with unknown properties. Porting over what C++ has and making a proper Random library for Ruby would make a lot of sense here.
Re: Ruby Bug: SecureRandom should try /dev/urandom first
#9"securerandom.rb will consume too much entoropy if /dev/urandom is used directry."
This is a quote for the ages.
Re: Ruby Bug: SecureRandom should try /dev/urandom first
#10So once again, the man page for urandom creates more problems than solutions. ( https://bugzilla.kernel.org/show_bug.cgi?id=71211 )
Why is there such a discrepancy between the prevailing sentiment on HN and the actions of whoever controls the manual? What is preventing one side from convincing the other, apart from stubbornness?
Also, why are the Ruby devs so dead set on the manual page?