Secure should really be seen as a necessary component of correct security. I don’t see random() as part of security, and the problem is that people use it as su

Secure should really be seen as a necessary component of correct security. I don’t see random() as part of security, and the problem is that people use it as such (that’s the failure of our profession as I see it). You wouldn’t want the default string equality operator to be constant time to prevent a possible timing attack, and in the same way I don’t think random() should be cryptographically secure by default. If you need secure random values, you are (should be) a domain-expert and should be selecting an appropriate cryptographically secure random generator from a security library, in the same way you would with a constant-time equality function. I guess it's a matter of perspective over who random() is for. I see random() as for the programmers who don't know what kind of randomness they need, and don't need to know that because they just need something 'random' not something secure. I expect the domain-experts to know that it's not what they need. In my mind it's not that random() is not secure, it's that using it for something it's not intended for is insecure.