3 ms·

> non-determinism in rand() if srand isn't ever called This is the path Go took for its math/rand library eventually: if you don't seed the RNG, it's a CSPRNG,

> non-determinism in rand() if srand isn't ever called This is the path Go took for its math/rand library eventually: if you don't seed the RNG, it's a CSPRNG, but if you do seed it, it's deterministic. However, there is lots of "advice" out there to seed your RNG with "random" values like the current time to make it "more secure" (and to be fair, in some cases, you may get sufficient entropy for the purpose at hand by doing this, but in most cases, you won't get enough and you'll spend it very fast). So a call to srand may indicate that you know what you're doing and want determinism and understand the consequences, but it doesn't necessarily mean that.

cpeterso 2y ago
> seed your RNG with "random" values like the current time Good point. srand(time(NULL)) is a common, yet nondeterministic, seed. The caller clearly doesn't expect rand() to generate a particular sequence of numbers, so srand() could check whether the given seed looks like a time_t close to the current time() and, if it does, then use a proper CSPRNG instead.
- leni536 2y ago
  That's a horrifying suggestion.
  - kbolino 2y ago
    Since any good solution would start with deleting rand and srand from the C standard library entirely, but that's never going to happen, we only have not-good solutions to consider.
__s 2y ago
Amusingly in go 1.24 they're turning srand into a nop: https://github.com/golang/go/issues/67273 https://github.com/golang/go/issues/67273