Post #2553672
2025-11-11 18:17 UTC
@dotstdy@mastodon.social @josh@social.joshtriplett.org @esoterra@hachyderm.io My understanding is, even an insecure PRNG wants at least a seed from somewhere, even if some users will chose to make the seed deterministic, others will want it to be nondeterministic. And obvious sources like clocks or other I/O aren't ideal because they could be virtualized for other purposes.
Replies (2)
-
@dotstdy@mastodon.social 2025-11-11 18:19
@sunfish@hachyderm.io @josh@social.joshtriplett.org @esoterra@hachyderm.io Yeah, I'm not disagreeing with the overall thing here, but if you want a non-deterministic seed for an insecure prng you can just use your secure prng. Thus, having a single interface for secure random data is sufficient to cover both use-cases.
-
@esoterra@hachyderm.io 2025-11-11 18:24
@sunfish@hachyderm.io I guess at that point you could have an API that returns a seed that's unique per instance, but maybe you might as well just let it return multiple at which point it's just an insecure RNG API and maybe that's fine or even simpler.