13 hours ago
On Tuesday, 16 September 2025 at 12:04:20 UTC, Denis Feklushkin wrote:
> No need to make ambitious interfaces

`std.internal.entropy` an internal module — not meant for user code.
From a user’s perspective, there is nothing to interface with.

> 1. Do not provide any access about entropy sources (I am about std.internal.entropy.EntropySource.tryAll and forceEntropySource). At the application programming level we usually have one source of true entropy. (If this is not so

`tryAll` in particular exists so that the module can be used in a backwards compatible manner to replace the low entropy solutions previously used underneath by Phobos. We’ve tried replacing them with one solution per platform directly and people got upset.

> At the application programming level we usually have one source of true entropy.

At Phobos v2 level, we have no source of true entropy. An application using only that library has therefore none.

At system level, there might be multiple options available — depending on factors like the OS version (like Linux kernels older than the `getrandom` syscall, or Windows that has two crypto APIs where the supported parameters have also changed over time) or the runtime environment (think of chroots without `/dev/`).
10 hours ago

On Sunday, 21 September 2025 at 11:54:22 UTC, Dennis wrote:

>

On Sunday, 21 September 2025 at 07:27:42 UTC, IchorDev wrote:

>

On Saturday, 20 September 2025 at 22:11:37 UTC, Dennis wrote:

>

On Saturday, 20 September 2025 at 18:42:03 UTC, IchorDev wrote:

>

Someone like you who can't understand the good parts of std.random's design has no place in suggesting changes to it.

Personal attacks are not allowed on this forum

What personal attack? There is no personal attack.

If you want an explanation, give that sentence to any LLM and it can tell you why it's a personal attack.

Do not insult my intelligence by implying that something with no comprehension of the context of our conversation understands what I said better than I do myself. An LLM is a clueless machine; we are people. You are fully capable of explaining your reasoning.

>

using more of this kind of language can get your post deleted.

Perhaps my statement was poorly worded, but I don't think that telling someone that they have no business trying to 'fix' something that they don't understand raises to the level of '[that] kind of language'; implying that I said something heinous about their character.

>

Denis Feklushkin has been very respectful so he's welcome to post suggestions for std.random.

And I will disagree when I think people are wrong.

10 hours ago
On Monday, 22 September 2025 at 00:29:11 UTC, IchorDev wrote:
>>> Someone like you who can't understand
> implying that I said something heinous about their character.

Its a personal attack
8 hours ago

On Monday, 22 September 2025 at 00:29:11 UTC, IchorDev wrote:

>

On Sunday, 21 September 2025 at 11:54:22 UTC, Dennis wrote:

>

Perhaps my statement was poorly worded, but I don't think that telling someone that they have no business trying to 'fix' something that they don't understand raises to the level of '[that] kind of language'; implying that I said something heinous about their character.

If you say anything negative about someone's character then it is by definition a personal attack. You're attacking the person, not his argument.

And what you're doing now is the equivalent of punching someone and then saying "but it's not like he died, really so what's the problem?" I mean if the upper threshold for "civil discourse" is saying something "heinous" well that leaves pretty much everything on the table.

7 hours ago

On Monday, 22 September 2025 at 00:29:11 UTC, IchorDev wrote:

>

Perhaps my statement was poorly worded, but I don't think that telling someone that they have no business trying to 'fix' something that they don't understand raises to the level of '[that] kind of language'; implying that I said something heinous about their character.

Whatever your intent, a moderator perceived it as a potential issue and, rather than deleting the post, asked you not to do it again. That was the right move and should have been the end of it. There's nothing to argue here.

So let's please get back on topic. I'll delete any further off topic posts.

Thanks!

2 hours ago

On Tuesday, 16 September 2025 at 12:04:20 UTC, Denis Feklushkin wrote:

>

I don't like the way the module std.random is designed

For one, I really hate how std.random is heavily templated, so it ends up being difficult to use in real-world scenarios where you might want to hot-swap the random engine for whatever reason. With current design choices, you are forced to template your stuff too, instead of just writing IRandom r = new WhateverRandom() and calling it a day.

It was so painful that I ended up doing this https://github.com/GrimMaple/mud/blob/master/source/mud/random.d , which I use heavily in my games for random level generation.
My current implementation is flawed - it should mark methods as final so the compiler can figure out to inline the calls when needed, but here's that.

1 hour ago

On Sunday, 21 September 2025 at 21:44:54 UTC, 0xEAB wrote:

>

On Tuesday, 16 September 2025 at 12:04:20 UTC, Denis Feklushkin wrote:

>

No need to make ambitious interfaces

std.internal.entropy an internal module — not meant for user code.
From a user’s perspective, there is nothing to interface with.

Yes. But I wrote this because I realized that access to getentropy and getrandom (here I mean system-independed analogs) is absolutely necessary and actually it is already implemented in std.internal.entropy

Otherwise, for example, if we want to generate 3 bytes of random numbers from freshly created Ranadom() we spent at least 4 bytes of expensive "true entropy" to establish our own PRNG, which we also declared as cryptographically insecure.

It's much easier and not error prone to directly access the system RNG or create our own generator with implicit global seed value (if system not provides CSPRNG for us). This will immediately make it possible to obtain crypto-secure random numbers.

> >
  1. Do not provide any access about entropy sources (I am about std.internal.entropy.EntropySource.tryAll and forceEntropySource). At the application programming level we usually have one source of true entropy. (If this is not so

tryAll in particular exists so that the module can be used in a backwards compatible manner to replace the low entropy solutions previously used underneath by Phobos. We’ve tried replacing them with one solution per platform directly and people got upset.

At the coding stage we know exactly what quality of random numbers we are agreed at this particular code point: maybe, people got upset because they actually wanted crypto-secure randoms? And if std.random returning the same sequence every time it's launched (I'm not even talking about cryptographic security), then this is most likely not what they want.

We could further add methods I suggested so that the user knows exactly what quality of random numbers they'll obtain. And then old interface can be deprecated over time.

> >

At the application programming level we usually have one source of true entropy.

At Phobos v2 level, we have no source of true entropy. An application using only that library has therefore none.

(But, in fact, for most modern systems we are calling getentropy inside of Phobos std.internal.entropy)

>

At system level, there might be multiple options available — depending on factors like the OS version (like Linux kernels older than the getrandom syscall, or Windows that has two crypto APIs where the supported parameters have also changed over time) or the runtime environment (think of chroots without /dev/).

Yes, I mentioned this: if TRNG isn't available, proposed functions simply won't be available. So user will either be forced to agree insecure pseudo-random sequences or be forced to find another way to achieve randomness.

1 hour ago

On Monday, 22 September 2025 at 09:37:28 UTC, Denis Feklushkin wrote:

> >

At system level, there might be multiple options available — depending on factors like the OS version (like Linux kernels older than the getrandom syscall, or Windows that has two crypto APIs where the supported parameters have also changed over time) or the runtime environment (think of chroots without /dev/).

Forgot to add: these options should not be selected automatically based on some heuristics. Because we know exactly the minimum level of quality of random numbers that we are willing to agree to.

>

Yes, I mentioned this: if TRNG isn't available, proposed functions simply won't be available. So user will either be forced to agree insecure pseudo-random sequences or be forced to find another way to achieve randomness.

1 2 3 4
Next ›   Last »