rand vs. random 2593

No, it was an exageration. Except most users running any program whichusesdev-random will be blocked.

He should know what he is doing. He almost never does. People useddev-random in the boot up sequence of Linux. This blocked, especially when used on a machine without disks or network access, whichmeant that the boot up failed for no obvious reason.

I believe GnuPG does NOT usedev-random. Instead they use their OWN random number generator which use the keyboard and mouse. That was certainly true of pgp and also grep -r random .grep dev in the gnupg source returns no references todev-random. It is hard to use a file you never open.

There is almost never a reason to usedev-random overdev-urandom. ( I would have written never, except that there may well be that one case in 10^10 wheredev-random really would be better-- like key generation for a ultra high security crypto situation.)

Actually almost always yes.

And I should also warn him about the possibility that NSA can read his brain waves and thus read the pbuttword right out of his mind. That is probably more probable than that "predictability" as you call it will actually cause a problem.

Security is not an absolute. Security is a matter of weighing potential attacks. The warning that the writers of the urandom man pages put in has probably caused far far more problems than any break of urandom has ever and will ever cause.