README.md in securer_randomer-0.1.6 vs README.md in securer_randomer-0.1.8
- old
+ new
@@ -1,19 +1,20 @@
# SecurerRandomer
+## This gem is deprecated. Please use [sysrandom](https://github.com/cryptosphere/sysrandom) instead.
+
[](https://travis-ci.org/mwpastore/securer_randomer)
[](https://badge.fury.io/rb/securer_randomer)
Ruby's SecureRandom prefers OpenSSL over other mechanisms (such as
`/dev/urandom` and `getrandom(2)`). This has recently garnered [some][1]
[criticism][2].
-[RbNaCl][3] provides Ruby bindings to [libsodium][4], a portable crypto
-library—which is a fork of [NaCl][6] by Daniel J. Bernstein—that
-includes hooks to alternative, OpenSSL-free pseudo-random number generators
-(PRNGs) such as `getrandom(2)` on modern Linux kernels and `RtlGenRandom()` on
-Windows.
+[RbNaCl][3] provides Ruby bindings to [libsodium][4]—a portable crypto
+library and fork of [NaCl][6] by Daniel J. Bernstein that includes hooks to
+alternative, OpenSSL-free pseudo-random number generators (PRNGs) such as
+`getrandom(2)` on modern Linux kernels and `RtlGenRandom()` on Windows.
This gem monkeypatches RbNaCl into SecureRandom and aims to be "bug-for-bug"
compatible with the "stock" implementation of SecureRandom across Ruby
versions. It also provides a bonus "do what I mean" random number method that
can be used instead of Kernel`.rand` and SecureRandom`.random_number`.
@@ -23,22 +24,23 @@
This gem started out as a very simple monkeypatch to
SecureRandom`.random_bytes` and grew as I dug deeper. In newer rubies, for
example, you need to patch `.gen_random` instead of `.random_bytes`, and it has
a different calling signature.
-Generating random numbers proved to be rather tricky due to inconsistencies of
-of Kernel`.rand` and SecureRandom`.random_number` between Ruby implementations
-and versions. For example:
+Some rubies use OpenSSL for SecureRandom`.random_number` as well, while others
+appear to rely on Kernel`.rand`. Addressing this proved to be tricky due to
+inconsistencies of these two methods between Ruby implementations and versions.
+For example:
* `Kernel.rand(nil)` and `SecureRandom.random_number(nil)` both return a float
`n` such that `0.0 <= n < 1.0` in Ruby 2.3; but
`SecureRandom.random_number(nil)` throws an ArgumentError in Ruby 2.2
* Kernel`.rand` with an inverted range (e.g. `0..-10`) returns `nil` in Ruby
2.2+, but SecureRandom`.random_number` throws an ArgumentError in Ruby 2.2
and returns a float `n` such that `0.0 <= n < 1.0` in Ruby 2.3
-Branching logic and tests started to accumulate so I decided it was probably a
-good idea to gemify this!
+Branching logic, edge cases, and tests started to accumulate so I decided it
+was probably a good idea to gemify this!
### Why a monkeypatch?
The concept of monkeypatching in Ruby is a sensitive subject. It has the
potential to break things in unexpected ways and make Ruby code more difficult