a version without deps on arc4random