[greenicon]

There shouldn’t be much of a difference, although the rust crate is more similar to the OpenSSL part. Just make sure to properly seed your CSPRNG, e.g. via using Rust’s ThreadRng[1]. In basically all cases there is no reason to use anything from the rand crate except ThreadRng.

1: https://rust-random.github.io/rand/rand/rngs/struct.ThreadRn...

[tptacek]

If you have to seed it, you're doing something wrong. You want to be using the system random number generator, the one the kernel provides, in preference to any userland RNG.

[josephg]

ThreadRng is what the GP recommended. From the linked page:

> ThreadRng is automatically seeded from OsRng with periodic reseeding (every 64 kiB, as well as “soon” after a fork on Unix — see ReseedingRng documentation for details).

Is the system's random number generator actually better than this? It looks like the rand developers know what they're doing, and using a library like this is attractive because I don't have to figure out the "right" random number API on different operating systems. (arc4random()? Is that only a macos thing? srandom()? random()? What is it on windows? Should I be reading from /dev/srandom or something? Etc.)