> The solution is to use 32 bytes of strong randomness to seed a userspace CSPRNG All cryptographic randomness generation should be performed by the kernel. Y

> The solution is to use 32 bytes of strong randomness to seed a userspace CSPRNG All cryptographic randomness generation should be performed by the kernel. You always have to think about security because if you don't think about security you're going to get hacked. By all means, name the insecure randomness generation function ‘insecure_random’. It does help. But secure-by-default helps you only marginally because when building secure software you don't get to just use the defaults; you have to think about what they're doing. You have to (for example) know and think about timing attacks even if you're using a cryptographic primitives library that's hardened against them, because it's really easy to introduce timing dependence into your own code and none of Daniel Bernstein or Tanja Lange’s careful designs will save you.