Re: noiz-0.5: simple noise-emitting package

[Matt Blaze <mab@research.att.com>]

This looks really cute, especially given the ability to "precompute"
entropy before the process that needs it is running.

An interface I'd rather see is one that allows a process to grab
random bits that it can be sure are not correlated to bits that
have been given to other processes.  Since everything runs asynchronously
with cron, you have no way of knowing how much time has elapsed since
the last time the file was read or updated, and hence don't know
how "fresh" the bits are.  Also, /etc/noiz is an attractive target
on multi-user machines....

So I'd rather see a /dev/noise, although a portable implementation
of somthing like that is out of the question now that there are
10 gazillion unix vendors.  Perhaps a more reasonable implementation
would be a tcp or rpc service that processes can query to get random bits,
where the server delays responding until it can guarantee that its
state is sufficiently decorrelated from previous responses.  Because you can
"bank up" entropy during idle periods, most requests could probably
be served without delay, making this technique a real advantage over
just implementing the same functions in a library called directly.
(Since good randomness is still rather expensive even when you can store it
up, and useless when sent over a network, you'd probably want the noise
server to refuse requests from outside the local machine.)

Anyway, I'm looking forward to playing with it.  It's a very nice idea.

-matt