Insecure Randomness in generate_secret_key.py

[tam7t]

Issue type: bug report

Python version:
NetBox version:

While the seed is cryptographically secure the random module uses the Mersenne Twister by default which is not secure.

Additionally, the way that random.seed works (by taking a hash of the provided value) results in a significantly smaller keyspace than intended.

[jeremystretch]

generate_secret_key.py is a convenience tool used to generate one-off random values for Django's SECRET_KEY configuration setting. If we were generating millions of keys per second, this might be a concern, but I see no reason to deviate from the current logic. (Additionally, the PR submitted against this would have reduced the key space by a factor of 12^50.)

[jeremystretch]

Spoke with @tam7t some more and now I understand what he was saying. I still want to avoid using the base64 library though.