4 ms·

The go-to source for randomness in Linux is /dev/urandom, is it not? I’m not sure the best way to make use of it as a source of random decimals — there are sur

The go-to source for randomness in Linux is /dev/urandom, is it not? I’m not sure the best way to make use of it as a source of random decimals — there are surely a dozen ways to do so — but this works: printf %d 0x` head -c 1000 /dev/urandom | shasum | head -c 8 ` As always, my advice for things like this is that if you’re in need of true random numbers in your shell script then you should probably stop writing whatever it is you are writing as a shell script.

masklinn 4y ago
> The go-to source for randomness in Linux is /dev/urandom, is it not? AFAIK it's the go-to source of randomness in any modern-ish unix. > I’m not sure the best way to make use of it as a source of random decimals — there are surely a dozen ways to do so — but this works: `od(1)` will do binary data to decimal: > head -c4 /dev/urandom | od -An -vtu4 4119929390 > head -c4 /dev/urandom | od -An -vtu4 3540752584 > head -c4 /dev/urandom | od -An -vtu4 998126897
ary 4y ago
> As always, my advice for things like this is that if you’re in need of true random numbers in your shell script then you should probably stop writing whatever it is you are writing as a shell script. The use of "true" here seems ambiguous. Does this statement mean that you discourage creation of cryptographic applications with shell scripts, you discourage use of shell scripts to orchestrate applications that use /dev/urandom for any reason, or something else entirely? (first, and only edit: This comment is in good faith, so if you're downvoting please respond to let me know why)
- noam_k 4y ago
  "True random" as opposed to "pseudo random", which is not cryptographically secure.
  - jimktrains2 4y ago
    There are cryptographically secure pseudorandom generators. In fact all sources non-hardware (i.e. /dev/random and /dev/urandom) are psuedo random as are the keystream generators for most algos that use one.
    - noam_k 4y ago
      TIL. Thanks!
  - ary 4y ago
    Yes, I'm aware of that. The commenter seems to be implying that one should stop using a shell script when one needs "true" random, and I'm curious as to why since one can call out to Perl, Python, etc. The linked gist doesn't appear to be making the case for using its recommendations in cryptographic applications so what I'm ultimately after is what the commenter thinks is being done in the shell that's inappropriate.
  - MattPalmer1086 4y ago
    Incorrect. I'm not sure what you mean by "true random", and we could get into some interesting philosophical discussion on that. However, all software random number generators are pseudo random, including cryptographic ones. They are called CSPRNGs, which stands for Cryptographically Secure Pseudo Random Number Generator.
chasil 4y ago
There are several scenarios where a cryptographic-quality random number generator might be needed within the context of a shell script. My favorite tool for this is "openssl rand" and I can find the manual page on rhel7 with "man rand." Here are 8 bytes of randomness in base64: $ openssl rand -base64 8 mGHxYcVOmA8= If you like decimal: $ printf %d\\n 0x$(openssl rand -hex 2) 21924 When I've got dozens of users to create, this is how I am assigning their initial passwords. The shell's $RANDOM is somewhat less trustworthy than other sources here. It also does not appear to be POSIX, but comes from ksh88, where it is described as returning a random integer between 0 and 32767 each time it is referenced. If unset in a script, it cannot be used again for the life of the shell.
- TRiG_Ireland 4y ago
  I use this to create passwords when I need to manually: function password_generate { head -c ${1-12} /dev/urandom | base64; }
  - chasil 4y ago
    Sometimes, extreme portability makes us do desperate things. # uname -a HP-UX prdcrm B.10.20 A 9000/800 862741461 two-user license # ls -l /dev/urandom /dev/urandom not found # openssl rand -base64 8 v51U1RvSD2Q= I could run this on VAX VMS if you want.
rascul 4y ago
If I recall correctly, /dev/urandom and /dev/random work the same now.
- dharmab 4y ago
  That change was reverted, and I do not know if they were re-unified since. https://lwn.net/Articles/889452/ https://lwn.net/Articles/889452/ Pragmatically, they are equivalent for most scripting use cases.
tzs 4y ago
Set RD to $N random bytes in decimal: RD=$(dc -e 16i`xxd -c $N -g $N -l $N -p /dev/urandom | tr a-f A-F`p)
- radiator 4y ago
  Unfortunately, this is neither readable nor particularly concise.
hayst4ck 4y ago
While being overly pedantic (because "not true" random is a spectrum), it is good practice to use random numbers to ensure that a recurring cron job does not run at the same time on all machines. This goes from good practice to necessary as a cron job uses increasing resources or talks to a centralized service. Puppet implements this as splay: https://www.puppet.com/docs/puppet/7/configuration.html#splay https://www.puppet.com/docs/puppet/7/configuration.html#spla...
- PointyFluff 4y ago
  [dead]
- dharmab 4y ago
  Systemd offers multiple options for randomized delays for timers, documented at: https://www.freedesktop.org/software/systemd/man/systemd.timer.html https://www.freedesktop.org/software/systemd/man/systemd.tim...
- kevin_thibedeau 4y ago
  You don't need the shell for that. Every modern cron supports randomization internally.
deleted 4y ago
[deleted]

masklinn 4y ago

> The go-to source for randomness in Linux is /dev/urandom, is it not? AFAIK it's the go-to source of randomness in any modern-ish unix. > I’m not sure the best way to make use of it as a source of random decimals — there are surely a dozen ways to do so — but this works: `od(1)` will do binary data to decimal: > head -c4 /dev/urandom | od -An -vtu4 4119929390 > head -c4 /dev/urandom | od -An -vtu4 3540752584 > head -c4 /dev/urandom | od -An -vtu4 998126897

ary 4y ago

> As always, my advice for things like this is that if you’re in need of true random numbers in your shell script then you should probably stop writing whatever it is you are writing as a shell script. The use of "true" here seems ambiguous. Does this statement mean that you discourage creation of cryptographic applications with shell scripts, you discourage use of shell scripts to orchestrate applications that use /dev/urandom for any reason, or something else entirely? (first, and only edit: This comment is in good faith, so if you're downvoting please respond to let me know why)

noam_k 4y ago
"True random" as opposed to "pseudo random", which is not cryptographically secure.
- jimktrains2 4y ago
  There are cryptographically secure pseudorandom generators. In fact all sources non-hardware (i.e. /dev/random and /dev/urandom) are psuedo random as are the keystream generators for most algos that use one.
  - noam_k 4y ago
    TIL. Thanks!
- ary 4y ago
  Yes, I'm aware of that. The commenter seems to be implying that one should stop using a shell script when one needs "true" random, and I'm curious as to why since one can call out to Perl, Python, etc. The linked gist doesn't appear to be making the case for using its recommendations in cryptographic applications so what I'm ultimately after is what the commenter thinks is being done in the shell that's inappropriate.
- MattPalmer1086 4y ago
  Incorrect. I'm not sure what you mean by "true random", and we could get into some interesting philosophical discussion on that. However, all software random number generators are pseudo random, including cryptographic ones. They are called CSPRNGs, which stands for Cryptographically Secure Pseudo Random Number Generator.

chasil 4y ago

There are several scenarios where a cryptographic-quality random number generator might be needed within the context of a shell script. My favorite tool for this is "openssl rand" and I can find the manual page on rhel7 with "man rand." Here are 8 bytes of randomness in base64: $ openssl rand -base64 8 mGHxYcVOmA8= If you like decimal: $ printf %d\\n 0x$(openssl rand -hex 2) 21924 When I've got dozens of users to create, this is how I am assigning their initial passwords. The shell's $RANDOM is somewhat less trustworthy than other sources here. It also does not appear to be POSIX, but comes from ksh88, where it is described as returning a random integer between 0 and 32767 each time it is referenced. If unset in a script, it cannot be used again for the life of the shell.

TRiG_Ireland 4y ago
I use this to create passwords when I need to manually: function password_generate { head -c ${1-12} /dev/urandom | base64; }
- chasil 4y ago
  Sometimes, extreme portability makes us do desperate things. # uname -a HP-UX prdcrm B.10.20 A 9000/800 862741461 two-user license # ls -l /dev/urandom /dev/urandom not found # openssl rand -base64 8 v51U1RvSD2Q= I could run this on VAX VMS if you want.

rascul 4y ago

If I recall correctly, /dev/urandom and /dev/random work the same now.

dharmab 4y ago
That change was reverted, and I do not know if they were re-unified since. https://lwn.net/Articles/889452/ https://lwn.net/Articles/889452/ Pragmatically, they are equivalent for most scripting use cases.

tzs 4y ago

Set RD to $N random bytes in decimal: RD=$(dc -e 16i`xxd -c $N -g $N -l $N -p /dev/urandom | tr a-f A-F`p)

radiator 4y ago
Unfortunately, this is neither readable nor particularly concise.

hayst4ck 4y ago

While being overly pedantic (because "not true" random is a spectrum), it is good practice to use random numbers to ensure that a recurring cron job does not run at the same time on all machines. This goes from good practice to necessary as a cron job uses increasing resources or talks to a centralized service. Puppet implements this as splay: https://www.puppet.com/docs/puppet/7/configuration.html#splay https://www.puppet.com/docs/puppet/7/configuration.html#spla...

PointyFluff 4y ago
[dead]
dharmab 4y ago
Systemd offers multiple options for randomized delays for timers, documented at: https://www.freedesktop.org/software/systemd/man/systemd.timer.html https://www.freedesktop.org/software/systemd/man/systemd.tim...
kevin_thibedeau 4y ago
You don't need the shell for that. Every modern cron supports randomization internally.

deleted 4y ago

[deleted]