Hi Christof:

In message
<1533420121.71.0.56676864532.issue2550988@psf.upfronthosting.co.za>,
Christof Meerwald writes:
>Christof Meerwald added the comment:
>
>Here is another patch that keeps the re-seeding in place, just moves 
>the selection of the preferred random number generation method into a 
>single module:
>
>https://bitbucket.org/cmeerw/roundup/commits/91c7933f5a95fc8f1f9867b5f7
>cd45f4430424d8

In your patch you seed a new random instance, not the default random
instance. You should also seed the default random instance on every
client session. The issue with the default pseudorandom number
generator not being seeded was detected by an extension on the
python.org bugtracker. The extension returned a random issue. That
stopped working because the default random generator was not seeded on
every client connection. While every extension writer could add their
own call to seed the ransom source, I think it is better if we seed it
with proper random info in the core.

So make sure you seed the random generator even if we don't use it in
the main roundup code. It is reasonable for tracker developers to
think that random is properly seeded on every client connection.

>(Note that I have removed some special "randomness" code for CSRF 
>handling as it seems strange to handle that in a different way than 
>gen_sid/gen_nonce in client.py; ideally, we would have a strong random 
>number generator anyway if we care about these things).

I'm ok with that if you believe that there is enough randomness in
roundup/anypy/random_.py when it takes the pseudorandom path.

Have a great week.