Ruby Bug: SecureRandom should try /dev/urandom first

Re:Ruby Bug: SecureRandom should try /dev/urandom first by disposeofnick9 on Wednesday May 04, 2016 @06:07AM (#11627310)

Code is useless if no one knows how to use it properly and it's not communicated clearly. Users certainly can't be expected to read every line of code. That's like shipping a car with no user manuals and saying "take the engine apart and see how it works." Arrogance.

Clearly document system behavior or code is essentially useless.

[ Parent | on HN ]

Re:Ruby Bug: SecureRandom should try /dev/urandom first by azet on Wednesday May 04, 2016 @07:59AM (#11627700)

Users of languages can't be expected to. Therefore the language designers and maintainers themselves, especially if they're working on the stdlib, should do so, IMO. It's not only education for a proficient programmer, it helps to understand the underlying system you're building on and it's security assumptions.

The random char device code isn't that hard to understand, and if you're not a strong C programmer (the Ruby-core people are good C programmers, I suppose) - there's a paper explaining how it works: https://eprint.iacr.org/2012/251.pdf

Aaron

[ Parent | on HN ]

Re:Ruby Bug: SecureRandom should try /dev/urandom first by batiste on Wednesday May 04, 2016 @10:57AM (#11628775)

Then I have a little quiz for you:

According to this documentation:

http://ruby-doc.org/core-2.1.2/Float.html#method-i-round

How do you explain?

2.1.2 :011 > 15.round(-1) => 20

[ Parent | on HN ]