News for hackers. Stuff that matters.
Re:Ruby Bug: SecureRandom should try /dev/urandom first by astrodust on Tuesday May 03, 2016 @08:59PM (#11625448)
This talk about C++ and rand being harmful is quite educational: https://channel9.msdn.com/Events/GoingNative/2013/rand-Consi...

What it points out is that even a good random number generator can be used incorrectly, and without the right tools your efforts to produce truly random numbers are doomed from the start.

C++ has an embarrassing wealth of random number generators. The Ruby core has almost nothing that can measure up to that, yet it seems like a huge oversight.

I like that C++ has a generator for many different use cases, they all have their reason for being there, but Ruby has a singular one with unknown properties. Porting over what C++ has and making a proper Random library for Ruby would make a lot of sense here.

Re:Ruby Bug: SecureRandom should try /dev/urandom first by tptacek on Tuesday May 03, 2016 @10:11PM (#11625687)
None of those C++ RNGs are suitable for cryptography. The answer for C++ CSPRNGs is, like in every other language, to use /dev/urandom. Multiple CSPRNGs just mean multiple single points of failure.
Re:Ruby Bug: SecureRandom should try /dev/urandom first by astrodust on Wednesday May 04, 2016 @07:09PM (#11632718)
Not every random number generator has to be cryptographically secure. Sometimes they just need to be properly random.