<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><br><div><div>On May 10, 2014, at 4:15 PM, Stefan Behnel <<a href="mailto:stefan_ml@behnel.de">stefan_ml@behnel.de</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><span style="font-family: ArialMT; font-size: 16px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;">Total +1 on keeping these little bits around.</span></blockquote></div><br><div>Since all of you want a warning, I'll add one back</div><div>but with improved wording.</div><div><br></div><div>I'm not all at comfortable with the wording of the second sentence.</div><div>I was the author of the SystemRandom() class and I only want</div><div>to guarantee that it provides access to the operating system's</div><div>source of random numbers. It is a bold claim to guarantee that</div><div>it is cryptographically secure (many such claims in the past have</div><div>turned-out to be false). We don't really know what it is going to</div><div>do on a VM for example.</div><div><br></div><div>Also, I don't want to call SystemRandom() a pseudo-random number</div><div>generator. It purports to be an actual random number generator</div><div>(or at least it purports to have used some real source of entropy at</div><div>some stage). To me (the module maintainer), that is an important distinction.</div><div><br></div><div><br></div><div>Raymond</div></body></html>