use_urandom 0.1.0 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: fb0f96584360eb42b51d25fa9fbe109a0bda441c
-  data.tar.gz: 7b4ab244cd02b8327266a7eccb2ab54cec589d99
+  metadata.gz: b43c4f499467f86061edcf8d3e037cdace0602f2
+  data.tar.gz: 5ce99576a00ed9acff19932dee27a9ef32fc1f83
 SHA512:
-  metadata.gz: 5ab9b49e1aeb578344673ef89a95743ac4063277f46fa6c1ebf7a0b4bd8a0c396bf55c222810bd89081fd73c170bd47f9ce0326f5dc7f370c15c8a9b27a6a687
-  data.tar.gz: 71631400b6a866670909e7e22f937776c1c533d01af7b9789be05966172d15e5b897fbe9ec99d3c3199e22ced36aa71d985489343d621a39c2a8a30f26317282
+  metadata.gz: ddc300a28ef2c8f909caf1704a6216ecf9084afba3e1157b90078c47e3b0e4cda33d1dea43cb20cc94605fd9d38df41988d00d7d279b6757da6d9f29b22d70a4
+  data.tar.gz: 833ca09b336e4c1f0bfd2089b9dfddca7bdbb23377a1e87574a28c0d1277580f8803632b58ac5652503a1a46be1c2df39a0d754d7f2d4ed733fc9e76e2f0758e

data/README.md

@@ -1,33 +1,30 @@
 # UseUrandom
-
+Turns out, Ruby's SecureRandom makes some poor design decisions.
 This gem monkey patches SecureRandom to use /dev/urandom.
 
-## Installation
-
-Add this line to your application's Gemfile:
-
-```ruby
-gem 'use_urandom'
-```
-
-And then execute:
-
-    $ bundle
-
-Or install it yourself as:
-
-    $ gem install use_urandom
+## FAQ
+### Why write this and what is wrong with SecureRandom?
+There are a lot of material involved in answering this, but the best starting point is [this HN thread, from which this gem was inspired](https://news.ycombinator.com/item?id=11624890)
+### What about Random.raw_seed?
+The purpose of this gem, as per the name, is to use /dev/urandom. That function takes several code paths, one possibility of which, is reading /dev/urandom. raw_seed() meanwhile, is written in C, and packed with #define's that control flow. I don't intend on auditing it line by line, and the fact this gem is necessary reduces needed limits my confidence in it.
+### But my server will run out of entropy!
+If you truly believe that, don't use this gem. Definitely don't open an issue demonstrating ignorance.
 
 ## Usage
 
 This gem is in the super pre-alpha stage and shouldn't be used.
+Just require it in your application:
+
+```ruby
+require 'use_urandom'
+```
 
+Any calls to SecureRandom will automatically get redirected to a read on /dev/urandom. Any failures get pushed back to the original code, with a warning raised. 
 
 ## Contributing
 
 Bug reports and pull requests are welcome on GitHub at https://github.com/technion/use_urandom.
 
-
 ## License
 
 The gem is available as open source under the terms of the [MIT License](http://opensource.org/licenses/MIT).

data/lib/use_urandom.rb

@@ -1,14 +1,19 @@
 require "use_urandom/version"
 
 module SecureRandom
+  # A constant for the file path used
+
+  URANDOM = "/dev/urandom"
+  # Hooks SecureRandom's self.gen_random
   class << self
     alias_method :original_gen_random, :gen_random
 
     def gen_random(n)
       begin
-        UseUrandom::urandom(n)
+        UseUrandom.urandom(n)
       rescue
-        warn "Using original"
+        # Fallback code - UseRandom raises exceptions on any problem
+        warn "Using original SecureRandom"
         original_gen_random(n)
       end
     end
@@ -16,13 +21,15 @@ module SecureRandom
 end
 
 module UseUrandom
-  URANDOM = "/dev/urandom"
 
+  # Reads 'n' bytes from URANDOm
   def self.urandom(n)
-    device = ($urandom_file_test.nil?) ? URANDOM : $urandom_file_test
-    fh = File.open device, 'rb'
-    raise "Invalid urandom file" unless (fh.stat.uid == 0 && fh.stat.gid == 0)
+    # Facilitates testing
+    fh = File.open SecureRandom::URANDOM, 'rb'
+    # Sanity test - owned by root
+    raise "Invalid urandom file" unless (fh.stat.uid == 0 && fh.stat.chardev?)
     data = fh.read(n)
+    fh.close
     raise "Not enough data read" unless data.size == n
     data
   end

data/lib/use_urandom/version.rb

@@ -1,3 +1,3 @@
 module UseUrandom
-  VERSION = "0.1.0"
+  VERSION = "0.2.0"
 end

data/use_urandom.gemspec

@@ -22,4 +22,5 @@ Gem::Specification.new do |spec|
   spec.add_development_dependency "bundler", "~> 1.11"
   spec.add_development_dependency "rake", "~> 10.0"
   spec.add_development_dependency "minitest", "~> 5.0"
+  spec.add_development_dependency "minitest-stub-const" , "~> 0.5"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: use_urandom
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.2.0
 platform: ruby
 authors:
 - Technion
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2016-05-04 00:00:00.000000000 Z
+date: 2016-05-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -52,6 +52,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '5.0'
+- !ruby/object:Gem::Dependency
+  name: minitest-stub-const
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.5'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.5'
 description: Prefer urandom to OpenSSL
 email:
 - technion@lolware.net