no need for arc4random_uniform() here