Thanks for cc-ing me. I don't have much exposure to random, so I am cc-ing the Cryptography list, in hopes they might help. This doesn't very random, you're right. Here were Peter's questions: My questions: 1) do we really want to have global fixed seed? 2) Random new should actually setup a usable seed so I don't need to first run it N times before I can use the value 3) Should we switch to what UUIDGenerator is using⦠reading /dev/urandom for the initial seed setup? Rob On 05/18/2016 07:05 PM, Peter Uhnák wrote:
Hi,
(cc-ing Robert Withers as he seems to be working with cryptography and security... as this seems related and may have some implications, but I am likely wrong about the implications)
yesterday I've encountered a very surprising behavior
I executed the same script `10 atRandom` on the same image without saving it and got the same output:
while true; do pharo-vm --nodisplay latest.image --no-default-preferences eval '10 atRandom' done 10 10 10 10 10 10
Not so random⦠not random at all.
Apparently the default random generator uses SharedRandom pool, that is initialized only once⦠so every time you start an image you get the EXACT same random seed... I think this is stupid, and I am not sure what are the security implications of this (e.g. when opening an SSL connection⦠having fixed world-wide initial seed seems like an awful, awful idea), but whateverâ¦
So instead I tried to explicitly specify the Random generator⦠which I can do
while true; do pharo-vm --nodisplay latest.image --no-default-preferences eval '10 atRandom: Random new' done 5 5 5 5 5
Still not random⦠what?
while true; do pharo-vm --nodisplay latest.image --no-default-preferences eval 'Random new instVarNamed: #seed' done 426306047 426305545 426305546 426306010
So the seed is different but thanks to the magic of masking the seed, I always get the same first several bits⦠thus the same result for small numbers.
So if I actually want what seems like a random value⦠I have to at least once run the generatorâ¦
while true; do pharo-vm --nodisplay latest.image --no-default-preferences eval '10 atRandom: (Random new next; yourself)' done 7 3 4 9 6 7
Once I start to use it the properties of the algo kick in so it's pseudo-random⦠but I need to run it once to initialize it, which is wtf.
My questions: 1) do we really want to have global fixed seed? 2) Random new should actually setup a usable seed so I don't need to first run it N times before I can use the value 3) Should we switch to what UUIDGenerator is using⦠reading /dev/urandom for the initial seed setup?
Peter