spell out kernel.rand since it's easier to test