@briansmith ring is indeed a great crate, and it's on the candidate list. I'm glad to hear you are confident that its random number facilities are the best in the ecosystem. It's been on my shortlist of crates the libs team might want to schedule soon.
Are you interested in having the community / libs team evaluate it as part of the libz blitz sometime?
I think it would make more sense to stabilize a new version of rand with a much simpler API like ring’s and the implementation details from ring (e.g. the feature flag to turn off the fallback to /dev/urandom for facilitating sandboxing that blocks file I/O syscalls).
There are lots of things that you could do in libstd that could be done in Rust, which currently require C/asm in ring because of the lack of stable (proper) access to syscalls and RDRAND/RDSEED in stable Rust, which is what ring targets.
In other words, I’m not proposing that ring be the replacement for rand, but rand’s API should be fixed to be closer to ring’s than its current API.
1.0 is partly marketing and partly about some kind of commitment to a stable API.
As far as marketing goes, I’ve debated releasing 1.0, 2.0, 3.0, etc. instead of 0.6, 0.7, 0.8, etc. but it doesn’t matter enough for me to bother with.
As far as the API stability goes, I know there will be more breaking changes (e.g. the AEAD API) this summer (I hope) but I’ve not considered trying to finalize any part of the API. Especially there are some parts of the API that would change if/when things like const fn and statics in constant position (e.g. x: [u8 ; ring::digest::SHA256::output_len];) were/are added to the language.
Regarding some things that are in the API guidelines, like the capitalization requirements for SHA256 vs Sha256, I’d like to see some evidence showing that those things actually have a significant positive difference vs. being over- or wrongly- specified before I make changes like that.
Awesome. It's yours! You can just run it in the same way as the previous one.
This week I am at a Mozilla all-hands and won't have much time to devote directly to this, but next I'll make sure we get some more evaluations underway.
I thought it was still worth time-boxing the evaluation component even though there isn’t a libs meeting. I gave it 2 weeks from today, but am happy to change or remove that.
Argh, it looks like I missed the status update last week again, and I’m not going to get it done today. Sorry for falling behind, but I will catch up next week. Thank you so much @KodrAus, @budziq, and @burntsushi for keeping things moving
Next week I will endeavor to catch up on reviews, open the rand evaluation, resolve a number of guidelines issues, and close out some of the early evaluations with version bumps and releases.
Howdy Brian, I’ve at last convinced my RNG-expert friend to start
concretely listing his discontents with the current rand lib and coding up
some prototypes of alternatives. Feel free to keep the rand review
scheduled for 7/25, hopefully we’ll have something more to chew on by this
week.
@budziq Yeah, I'll follow up on this. We're going to need to put some effort into it to get people to relicense.
@bstrie I've spoken with @bhickey a bit and encouraged them to participate in the upcoming showdown.
I've signed myself up to lead the rand evaluation and will open it ... Friday I think.
I also added toml to the desired out-of-band evaluations after an unsatisfying experience trying to lead somebody through the docs over the weekend. I intend to solicit more help leading these evaluations to the twir call for participation, but am still agonizing over the difficulty of motivating crate leads (thanks so much @KodrAus ). I think it's a pretty intimidating process but it's actually really simple to e.g. go over the toml crate and make a list of documentation remediations.