Node: Why not provide a function of secureRandom?

[rabbitooops]

Node.js only provides strong pseudo-random data.
Why not provide a real random data?

[bnoordhuis]

Define 'real random data'?

[benjamingr]

@rabbitmeow I'll try to answer this less cleverly.

In order to generate real random data you need a real random data source. There are node modules that actually do that for you true-random for example. You can also use random.org for real random numbers.

In practice for the vast majority of Node.js applications - using pseudorandom generation (like virtually every other such platform) is sufficient, secure and standard. When you call crypto.randomBytes(size[, callback]) the generated data is cryptographically secure - which is what most people care about when they say "random".

Node.js typically includes features that can't be implemented in a user-land module in order to keep the core small. Node doesn't really have any advantage on top of a user-land module here and in terms of the data source - you'd have to solve that anyway.

[rabbitooops]

Thank-you every much. 😁