> Second, unless you can guarantee you support blocking / non-blocking behavior on all platforms, this is a bad move.
Well, there are two options:
* Detect when os.urandom() is going to block, and falls back to weaker entropy (Linux: /dev/urandom in non-blocking mode, others: getpid+time?).
* Never use os.urandom() to seed random.Random when the randim module is imported: I suggest to discuss this option in the issue #27272
I would prefer to collect enough technical information before taking a decision (ensure that it's not possible to get a portable function to check if /dev/urandom is going to block.) |