Is that the case for all platforms and C libraries? Also, isn't seeding with the current time a way to guarantee deterministic behavior? An attacker of such an algorithm probably knows what time it is, and users probably don't expect all invocations within a given second to return the same results.