Myths about /dev/urandom
Report a link problem
The originally submitted URL now redirects to the address above. Updating the destination does not change the item’s HN history, Hall membership, or rank.
Submission timeline
2007–2026One slot for every year since HN launched. Height is that year's peak points; orange marks a 100+ point or 50+ comment breakout. Select a bar to open its strongest thread.
First comments on top threads
HN comment orderCould someone explain DJB's point to me: Cryptographers are certainly not responsible for this superstitious nonsense. Think about this for a moment: whoever wrote the /dev/random manual page seems to simultaneously believe that (1) we can't figure out how to deterministically expand one 256-bit /dev/random output into an endless stream of unpredictable keys (this is what we need from urandom), but (2) we _can_ figure out how to use a single key to safely encrypt many messages (this is what…
I've given up on the hope that these myths will ever die. Every time it's relevant, someone pipes up complaining urandom isn't safe for use, or will run out of entropy. Have a look at the bugs for Node, Ruby and Wordpress. And inevitably, the appeal to authority ends up referring to these projects. Serious question, if I submitted a patch for the man page detailing the content of this myths page, is there a chance it might go somewhere…
Why hasn't someone qualified re-written that unix man page by now? I've been reading cryptographers trying to explain all of this for a while now. I feel like that would help put a lot of this to rest and save everyone time.
(disclaimer I sell a HW random number generator) I think both the diagrams here are simplistic - in reality pre 4.8 there were 3 pools (an input pool and 2 output pools, one of which blocked) and post 4.8 where there are 2 pools, an input pool and a blocking pool (urandom now pulls from the input pool thru a CSPRNG). One big downside of the new (post 4.8) architecture is that urandom_min_reseed_secs is ignored - pre-4.8 you could ask…
The first top-level comment from each of the four biggest threads, in HN’s own order. Excerpts are shortened; open a comment for full context.
- Breakout years
- 5
- Total points
- 869
- Total comments
- 534
100+ points or 50+ comments
reference only — not used in Hall rules or ranking
reference only — not used in Hall rules or ranking
Every submission
| Date | Title as submitted | By | Points | Comments |
|---|---|---|---|---|
| 2014-03-07 | Myths about /dev/urandomFirst breakout · Best thread | Tomte | 232 | 171 |
| 2015-03-22 | Myths about /dev/urandom | Tsiolkovsky | 1 | 0 |
| 2015-05-23 | Myths about /dev/urandom | alanfranzoni | 1 | 0 |
| 2015-08-31 | Myths about /dev/urandom | petrosagg | 186 | 106 |
| 2017-01-06 | Myths about /dev/urandom (2014)Hall induction | Ivoah | 201 | 104 |
| 2018-05-02 | Myths about /dev/urandom | georgecmu | 2 | 0 |
| 2018-08-17 | Myths about /dev/urandom (2014) | mindcrime | 80 | 68 |
| 2019-11-26 | Myths about /Dev/Urandom | lunchbreak | 3 | 0 |
| 2020-02-10 | Myths about /Dev/Urandom | ingve | 5 | 0 |
| 2020-03-23 | Myths about /dev/urandom | CraneWorm | 2 | 0 |
| 2020-03-25 | Myths about /dev/urandom (2014) | labguy | 67 | 35 |
| 2026-05-14 | Myths about /dev/urandomLatest 20+ point return | signa11 | 89 | 50 |