former cannot fail, works in chroot and is resistant against file descriptor exhaustion. Override random source with a local patch. OK wen heping