Subject: Re: lib/32258 (rand() creates bad random numbers.)
To: None <lib-bug-people@netbsd.org, netbsd-bugs@netbsd.org,>
From: None <kleink@netbsd.org>
List: netbsd-bugs
Date: 12/06/2005 22:16:05
Synopsis: rand() creates bad random numbers.

State-Changed-From-To: open->closed
State-Changed-By: kleink@netbsd.org
State-Changed-When: Tue, 06 Dec 2005 22:16:03 +0000
State-Changed-Why:
First, random() may not be in both ISO C and POSIX, but it actually is
in POSIX, which makes the availability picture not as gloomy as you're
drawing it.

Second, the proposed patch is missing rand_r().  The question whether
this was omitted intenionally or not set aside, neither the resulting
asymmetry of rand() and rand_r() nor the non-availability of the
caller-supplied seed to rand_r() through a wrapping around random()
are desirable outcomes.

Third, turning this into wrappers around random() using the same
state would result in an implementation no longer conforming to the
standard, and applications must be able to rely on the property of
sequence repeatability despite intermediate modification of the
random() state.  On the other hand, I agree with the observation
that adding extra state for rand() would be bloat.

Also, I'd like to note that there are applications where the cheapness
of a PRNG comes before its quality; that's why there are several to
choose from, and rand() has forever been known to address the
aforementioned needs.  In summary, I think this change should not be
applied.