On May 10, 2014, at 4:15 PM, Stefan Behnel <stefan_ml@behnel.de> wrote:

Total +1 on keeping these little bits around.

Since all of you want a warning, I'll add one back
but with improved wording.

I'm not all at comfortable with the wording of the second sentence.
I was the author of the SystemRandom() class and I only want
to guarantee that it provides access to the operating system's
source of random numbers. It is a bold claim to guarantee that
it is cryptographically secure (many such claims in the past have
turned-out to be false).  We don't really know what it is going to
do on a VM for example.

Also, I don't want to call SystemRandom() a pseudo-random number
generator.  It purports to be an actual random number generator
(or at least it purports to have used some real source of entropy at
some stage).  To me (the module maintainer), that is an important distinction.


Raymond