Thanks for cc-ing me. I don't have much exposure to random, so I am cc-ing the Cryptography list, in hopes they might help. This doesn't very random, you're right. Here were Peter's questions:

My questions:
1) do we really want to have global fixed seed?
2) Random new should actually setup a usable seed so I don't need to first run it N times before I can use the value
3) Should we switch to what UUIDGenerator is using��� reading /dev/urandom for the initial seed setup?
Rob


On 05/18/2016 07:05 PM, Peter Uhn��k wrote:
Hi,

(cc-ing Robert Withers as he seems to be working with cryptography and security... as this seems related and may have some implications, but I am likely wrong about the implications)

yesterday I've encountered a very surprising behavior

I executed the same script `10 atRandom` on the same image without saving it and got the same output:

while true; do
�� �� �� �� pharo-vm --nodisplay latest.image --no-default-preferences eval '10 atRandom'
done
10
10
10
10
10
10

Not so random��� not random at all.

Apparently the default random generator uses SharedRandom pool, that is initialized only once��� so every time you start an image you get the EXACT same random seed... I think this is stupid, and I am not sure what are the security implications of this (e.g. when opening an SSL connection��� having fixed world-wide initial seed seems like an awful, awful idea), but whatever���

So instead I tried to explicitly specify the Random generator��� which I can do

while true; do
�� �� �� �� pharo-vm --nodisplay latest.image --no-default-preferences eval '10 atRandom: Random new'
done
5
5
5
5
5

Still not random��� what?

while true; do
�� �� �� �� pharo-vm --nodisplay latest.image --no-default-preferences eval 'Random new instVarNamed: #seed'
done
426306047
426305545
426305546
426306010

So the seed is different but thanks to the magic of masking the seed, I always get the same first several bits��� thus the same result for small numbers.

So if I actually want what seems like a random value��� I have to at least once run the generator���

while true; do
�� �� �� �� pharo-vm --nodisplay latest.image --no-default-preferences eval '10 atRandom: (Random new next; yourself)'
done
7
3
4
9
6
7

Once I start to use it the properties of the algo kick in so it's pseudo-random��� but I need to run it once to initialize it, which is wtf.

My questions:
1) do we really want to have global fixed seed?
2) Random new should actually setup a usable seed so I don't need to first run it N times before I can use the value
3) Should we switch to what UUIDGenerator is using��� reading /dev/urandom for the initial seed setup?

Peter