Default of securerandom.source in java.security

[chkpnt]

In /layers/paketo-buildpacks_bellsoft-liberica/jre/conf/security/java.security, securerandom.source is set to file:/dev/random.

I know I can override this by using the system property java.security.edg. But as it's about containers: Wouldn't it make sense to set the default to file:/dev/urandom due to the blocking nature of /dev/random?

[dmikusa]

The buildpacks don't change that setting, it ships that way from Bellsoft. Other vendors may use different settings, although I haven't checked to see for sure.

Are you having a specific issue with randomness? I do recall this being something in the past, but it's not come up in a long time, and my understanding is that /dev/random no longer blocks on Linux, see this note for details/timeline.

[chkpnt]

Years ago I had issues. As far as I remember, I had a database connection using Oracle's JDBC driver which sometimes hung due to low entropy (Java 7 or 8). Using -Djava.security.egd=file:/dev/./urandom helped back then. And since then, I've always used it in order to prevent issues precautiously, as it is still mentioned in various threads like this one.

But you're right, that might be cargo cult! Thanks for pointing to the changes in the Linux kernel I wasn't aware of!