On Mon, 2 Jun 2014, Daniel Stenberg wrote:

> If we really want to add more "randomness", wouldn't it be better to call
> Curl_rand() two more times instead? It is getting "real" random data from
> the underlying TLS/crypto library and that is bound to be safer than adding
> the current time.

I suggest this simple patch - see attachment.

It also has the added benefit that once I (finally) add my code that "fakes"
Curl_rand() for debug builds we won't have to have any DEBUGBUILD conditionals
in that code path - having the time/date involved would make that harder.

-- 
  / daniel.haxx.se

-------------------------------------------------------------------
List admin: http://cool.haxx.se/list/listinfo/curl-library
Etiquette: http://curl.haxx.se/mail/etiquette.html