{"action":"closed","issue":{"url":"https://api.github.com/repos/stainless-steel/temporary/issues/1","repository_url":"https://api.github.com/repos/stainless-steel/temporary","labels_url":"https://api.github.com/repos/stainless-steel/temporary/issues/1/labels{/name}","comments_url":"https://api.github.com/repos/stainless-steel/temporary/issues/1/comments","events_url":"https://api.github.com/repos/stainless-steel/temporary/issues/1/events","html_url":"https://github.com/stainless-steel/temporary/issues/1","id":352672999,"node_id":"MDU6SXNzdWUzNTI2NzI5OTk=","number":1,"title":"The directory name is not actually random, `unsafe` code.","user":{"login":"dpc","id":9209,"node_id":"MDQ6VXNlcjkyMDk=","avatar_url":"https://avatars2.githubusercontent.com/u/9209?v=4","gravatar_id":"","url":"https://api.github.com/users/dpc","html_url":"https://github.com/dpc","followers_url":"https://api.github.com/users/dpc/followers","following_url":"https://api.github.com/users/dpc/following{/other_user}","gists_url":"https://api.github.com/users/dpc/gists{/gist_id}","starred_url":"https://api.github.com/users/dpc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dpc/subscriptions","organizations_url":"https://api.github.com/users/dpc/orgs","repos_url":"https://api.github.com/users/dpc/repos","events_url":"https://api.github.com/users/dpc/events{/privacy}","received_events_url":"https://api.github.com/users/dpc/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2018-08-21T19:13:24Z","updated_at":"2018-08-25T12:45:23Z","closed_at":"2018-08-25T12:45:23Z","author_association":"NONE","body":"90% of the reason one needs a temporary directory, is for it not to collide when multiple instances of the same process are running. As it is right now, the name collides, because the suffix is not chosen at random, because it is seeded. So what's the point of calculating the suffix in the first place?\r\n\r\nOn top of it, when reviewing the code I've noticed that the \"random\" suffix is generated with `unsafe`? What's the point? I'm creating a directory, so this operation is going to be super slow anyway. Using `unsafe` in Rust is a no-no, until it's absolutely necessary. In this case, it's just unjustified.\r\n\r\nAnd why is this library using `random` instead of `rand`? The randomness is a big part of generating temporary directory. In some use cases it might be very important for the security. Noone should use a custom random number, instead of the standard, well accepted and reviewed one.\r\n\r\nI'm sorry if I'm being mistake somewhere, and if I appear unreasonably harsh, but it seems to me, right now this crate is a footgun, and it might put some unaware users into trouble. If there was a way to flag it as \"not safe to use\" I would totally do it. Generating a tmp directory is not very dificult and I could have done it inline. Instead I used a 3rd party crate, and now I regret it, because I've discovered multiple problems with the code that seems rather simple to do right. :/"}}
{"actor":{"display_login":"IvanUkhov"}}