I understand the "broken benchmarks" problem and I acknowledge that there are some cases that are so demanding and have such low security sensitivity that it makes sense to have an LCG in the standard library.
But I stand by my argument that the default platform RNG should be a CSPRNG, and that developers should reach for a CSPRNG by default.
Which makes all the attention we've been giving to stuff like xoroshiro128+ and PCG pretty confusing to me. It feels like people arguing very earnestly about non-problems, while ignoring a huge problem in our standard libraries.
But I stand by my argument that the default platform RNG should be a CSPRNG, and that developers should reach for a CSPRNG by default.
Which makes all the attention we've been giving to stuff like xoroshiro128+ and PCG pretty confusing to me. It feels like people arguing very earnestly about non-problems, while ignoring a huge problem in our standard libraries.