News for hackers. Stuff that matters.
Re:Ruby Bug: SecureRandom should try /dev/urandom first by viraptor on Tuesday May 03, 2016 @08:13PM (#11625271)
Depends on why you want to use a random number generating library. What are your requirements and specifically what are your requirements that aren't satisfied with the system's csprng. Once you have that defined, you can start looking at what algorithms you want and from there what libraries implement it.

Edit: or to put another way, first define what is it that linux's getrandom() and /dev/urandom doesn't provide you.

Re:Ruby Bug: SecureRandom should try /dev/urandom first by astrodust on Tuesday May 03, 2016 @08:59PM (#11625448)
This talk about C++ and rand being harmful is quite educational: https://channel9.msdn.com/Events/GoingNative/2013/rand-Consi...

What it points out is that even a good random number generator can be used incorrectly, and without the right tools your efforts to produce truly random numbers are doomed from the start.

C++ has an embarrassing wealth of random number generators. The Ruby core has almost nothing that can measure up to that, yet it seems like a huge oversight.

I like that C++ has a generator for many different use cases, they all have their reason for being there, but Ruby has a singular one with unknown properties. Porting over what C++ has and making a proper Random library for Ruby would make a lot of sense here.

Re:Ruby Bug: SecureRandom should try /dev/urandom first by tptacek on Tuesday May 03, 2016 @10:11PM (#11625687)
None of those C++ RNGs are suitable for cryptography. The answer for C++ CSPRNGs is, like in every other language, to use /dev/urandom. Multiple CSPRNGs just mean multiple single points of failure.
Re:Ruby Bug: SecureRandom should try /dev/urandom first by astrodust on Wednesday May 04, 2016 @07:09PM (#11632718)
Not every random number generator has to be cryptographically secure. Sometimes they just need to be properly random.