On: Exploit Information Leaks in Random Numbers from Python, Ruby and PHP

[tptacek]

You should probably use your system urandom/random in preference to any application-layer CSPRNG. Your OS developers are charged with maintaining a high-profile high-value CSPRNG used for most applications on the system, and vulnerabilities in it are a hair-on-fire problem. The same is not true of application-layer replacements. The kernel RNG is also in a privileged position to collect entropy.

[wglb → tptacek]

And what about them new-fangled Intel random number generating instructions?

[tptacek → wglb]

You should trust that your OS will use them when it makes sense to use them. :)

(I'm being glib.)

[wglb → tptacek]

And I was being a bit silly.