Re: [Python-Dev] PEP 506 secrets module

2015-10-16 Thread Guido van Rossum
Single-argument randrange(n) is the same as randbelow(n), right? I don't see any reason to have randbelow() if that's true. On Fri, Oct 16, 2015 at 11:29 AM, Serhiy Storchaka wrote: > On 16.10.15 19:26, Steven D'Aprano wrote: > >> On Fri, Oct 16, 2015 at 06:35:14PM +0300, Serhiy Storchaka wrote:

Re: [Python-Dev] PEP 506 secrets module

2015-10-16 Thread Serhiy Storchaka
On 16.10.15 19:26, Steven D'Aprano wrote: On Fri, Oct 16, 2015 at 06:35:14PM +0300, Serhiy Storchaka wrote: I suggest to add only randrange(). randint() is historical artefact, we shouldn't repeat this mistake in new module. The secrets module is not good way to generate dice rolls. In most othe

Re: [Python-Dev] PEP 506 secrets module

2015-10-16 Thread Steven D'Aprano
On Fri, Oct 16, 2015 at 06:35:14PM +0300, Serhiy Storchaka wrote: > I suggest to add only randrange(). randint() is historical artefact, we > shouldn't repeat this mistake in new module. The secrets module is not > good way to generate dice rolls. In most other cases you need to > generate inte

[Python-Dev] Summary of Python tracker Issues

2015-10-16 Thread Python tracker
ACTIVITY SUMMARY (2015-10-09 - 2015-10-16) Python tracker at http://bugs.python.org/ To view or respond to any of the issues listed below, click on the issue. Do NOT respond to this message. Issues counts and deltas: open5152 ( +8) closed 32026 (+55) total 37178 (+63) Open issues wit

Re: [Python-Dev] PEP 506 secrets module

2015-10-16 Thread Serhiy Storchaka
On 16.10.15 09:57, Victor Stinner wrote: I suggest to raise an error if token_bytes(n) if calls with n < 16 bytes (128 bits). Well, I'm not sure that 16 is the good compromise between performance and security, but we must enforce users to use a minimum number of bits of entropy. token_bytes(1) lo

Re: [Python-Dev] PEP 506 secrets module

2015-10-16 Thread Chris Angelico
On Fri, Oct 16, 2015 at 9:04 PM, Steven D'Aprano wrote: > On Fri, Oct 16, 2015 at 08:57:24AM +0200, Victor Stinner wrote: >> Hi, >> >> I like the PEP. IMHO it's a better solution than using a CPRNG for >> random by default. >> >> I suggest to raise an error if token_bytes(n) if calls with n < 16 >

Re: [Python-Dev] PEP 506 secrets module

2015-10-16 Thread Steven D'Aprano
On Fri, Oct 16, 2015 at 08:57:24AM +0200, Victor Stinner wrote: > Hi, > > I like the PEP. IMHO it's a better solution than using a CPRNG for > random by default. > > I suggest to raise an error if token_bytes(n) if calls with n < 16 > bytes (128 bits). Well, I'm not sure that 16 is the good compr

Re: [Python-Dev] PEP 506 secrets module

2015-10-16 Thread Victor Stinner
Hi, I like the PEP. IMHO it's a better solution than using a CPRNG for random by default. I suggest to raise an error if token_bytes(n) if calls with n < 16 bytes (128 bits). Well, I'm not sure that 16 is the good compromise between performance and security, but we must enforce users to use a min