-
Notifications
You must be signed in to change notification settings - Fork 559
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Simplify the recommended alternatives to rand() #22873
base: blead
Are you sure you want to change the base?
Conversation
The CPAN Security Group (CPANSec) is currently working on guides to generating security-quality random data. We are focusing on modules that have secure defaults and are fairly lightweight. We would like to change the recommended modules to ones that we think are better options. Crypt::URandom is pure-perl, has fewer prerequisites than Crypt::Random, and works with Windows. Crypt::PRNG has secure defaults and methods for generating different kinds of random data.
We will need to get this p.r. to pass t/porting/podcheck.t before we can proceed further. |
The podchecker utility installed with Perl says it's ok. When I run it I get a compilation error that seems to have nothing to do with my change:
|
The failure is noted in the github actions run, it is because the pod checker must be told about the new non-core modules you are linking to:
|
I've updated it, and also updated other references to Math::TrulyRandom. |
The only failing tests are cygwin, which I think has nothing to do with the POD changes. |
The CPAN Security Group (CPANSec) is currently working on guides to generating security-quality random data. We are focusing on modules that have secure defaults and are fairly lightweight.
We would like to change the recommended modules to ones that we think are better options.
Crypt::URandom is pure-perl, has fewer prerequisites than Crypt::Random, and works with Windows.
Crypt::PRNG has secure defaults and methods for generating different kinds of random data.
Math::Random::Secure has a lot of prerequisites and in the end is just relying on /dev/urandom, like Crypt::URandom does.
Math::TrulyRandom is from 1996, and it's unclear how well that technique will work on modern systems, especially VMs and containers.