Path: csiph.com!eternal-september.org!feeder.eternal-september.org!mx02.eternal-september.org!.POSTED!not-for-mail
From: Marko Rauhamaa <marko@pacujo.net>
Newsgroups: comp.lang.python
Subject: Re: Make a unique filesystem path, without creating the file
Date: Mon, 22 Feb 2016 21:32:44 +0200
Organization: A noiseless patient Spider
Lines: 18
Message-ID: <87vb5gmtgj.fsf@elektro.pacujo.net>
References: <85r3gf55k4.fsf@benfinney.id.au> <CAG93HwHjKewu-VHUUc1jL=cU-pDNxVtKxx6ORyr+mdLLSJx2TA@mail.gmail.com> <CAG93HwGRsvcc=9rGgOA=oi6C-3pTk-Kr3g4dxCN0ivvixTVPWw@mail.gmail.com> <85mvr26dij.fsf@benfinney.id.au> <mailman.44.1456164660.20994.python-list@python.org> <slrnncmkag.16b.jon+usenet@wintry.unequivocal.co.uk> <mailman.45.1456165511.20994.python-list@python.org> <slrnncmllh.16b.jon+usenet@wintry.unequivocal.co.uk> <mailman.46.1456167850.20994.python-list@python.org> <slrnncmo5e.16b.jon+usenet@wintry.unequivocal.co.uk>
Mime-Version: 1.0
Content-Type: text/plain
Injection-Info: mx02.eternal-september.org; posting-host="b7cb1518d23ec19d482dcc9c31d30fdd"; logging-data="8522"; mail-complaints-to="abuse@eternal-september.org";	posting-account="U2FsdGVkX18M6qyyiiye5+VVgqPQ75ev"
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.5 (gnu/linux)
Cancel-Lock: sha1:/gF/O18+PIKZWU9q4C+rJQC7H7M= sha1:GB3vtGKB3Uqu2SnYNKYMBI6Qvfs=
Xref: csiph.com comp.lang.python:103359

Jon Ribbens <jon+usenet@unequivocal.co.uk>:

> Suppose you had code like this:
>
>   filename = binascii.hexlify(os.urandom(16)).decode("ascii")
>
> Do we really think that is insecure or that there are any practical
> attacks against it? It would be basically the same as saying that
> urandom() is broken, surely?

urandom() is not quite random and so should not be considered
cryptographically airtight.

Under Linux, /dev/random is the way to go when strong security is
needed. Note that /dev/random is a scarce resource on ordinary systems.


Marko