Author vstinner
Recipients pitrou, rhettinger, serhiy.storchaka, vstinner
Date 2017-04-20.12:18:33
SpamBayes Score -1.0
Marked as misclassified Yes
Message-id <>
"Generating every name consumes about 16 random bytes. This can exhaust the system entropy and slowdown other applications."

Crys and Alex_Gaynor confirmed me on IRC that these two assumptions are both wrong.

See for example

Q: But that's good! /dev/random gives out exactly as much randomness as it has entropy in its pool. /dev/urandom will give you insecure random numbers, even though it has long run out of entropy.

A:  Fact: No. Even disregarding issues like availability and subsequent manipulation by users, the issue of entropy “running low” is a straw man. About 256 bits of entropy are enough to get computationally secure numbers for a long, long time. 


About performance, well, it's not exactly "wrong" but "inaccurate". Abusing /dev/urandom only hurt other applications which also abuse /dev/urandom. Such use case is very unlikely.

* The bad performance of concurrent /dev/urandom reader was analyzed by an old article of 2014, but see comments:
* The performance issue was fixed in Linux 4.8,
Date User Action Args
2017-04-20 12:18:33vstinnersetrecipients: + vstinner, rhettinger, pitrou, serhiy.storchaka
2017-04-20 12:18:33vstinnersetmessageid: <>
2017-04-20 12:18:33vstinnerlinkissue30030 messages
2017-04-20 12:18:33vstinnercreate