News for hackers. Stuff that matters.

A comment on Predicting the next Math.random() in Java. Parent comment

Re:Predicting the next Math.random() in Java by Osmium on Monday September 01, 2014 @02:22PM (#8254092)
Devil's advocate, but why not rename "Random" to "AlmostRandom" instead, and call "SecureRandom" just "Random"? It's not unreasonable for a lay programmer to expect "random" to be exactly that; though, obviously, non-experts shouldn't be implementing crypto regardless. But since they will, despite everyone's best advice otherwise, why not reduce their chances of introducing bugs?
[ Parent | on HN ]
Re:Predicting the next Math.random() in Java by sgift on Monday September 01, 2014 @02:27PM (#8254110)
How far do you want to go? The Javadocs state it plain and clear that this is not cryptographically secure. Is AlmostRandom enough? Maybe we should force people to set an enum? new AlmostRandom(AlmostRandomCertification.YES_I_M_NOT_AN_IDIOT_AND_WONT_USE_THIS_FOR_CRYPTOGRAPHIC_PURPOSES)? You have to draw the line somewhere.
[ Parent | on HN ]
Re:Predicting the next Math.random() in Java by jonahx on Monday September 01, 2014 @02:35PM (#8254145)
True, although honestly your tongue-in-cheek enum example is probably closer to where the line should be.
[ Parent | on HN ]
Re:Predicting the next Math.random() in Java by cornewut on Monday September 01, 2014 @02:59PM (#8254232)
Also a nice reminder: "Never write your own crypto"
[ Parent | on HN ]
Re:Predicting the next Math.random() in Java by eru on Monday September 01, 2014 @08:49PM (#8255246)
(Outside of education.)
[ Parent | on HN ]
Re:Predicting the next Math.random() in Java by imaginenore on Monday September 01, 2014 @03:15PM (#8254286)
Because

1) Even SecureRandom is likely not completely random. Unless they seed with physical/unpredictable randomness.

2) It's much slower

[ Parent | on HN ]
Re:Predicting the next Math.random() in Java by pkolaczk on Tuesday September 02, 2014 @04:09AM (#8256302)
> 1) Unless they seed with physical/unpredictable randomness.

They do.

[ Parent | on HN ]
Re:Predicting the next Math.random() in Java by MichaelGG on Monday September 01, 2014 @03:49PM (#8254415)
Why not rename comparison functions, too, since they often aren't constant time? And all sorts of other primitives someone might accidentally use?
[ Parent | on HN ]