Ensure that the mask is well-formed.
Mask all the sent messages.
Use OpenSSL for strong random bytes if available.

Quoting the RFC:

    > The masking key is a 32-bit value chosen at random by the client.
    > When preparing a masked frame, the client MUST pick a fresh
    > masking key from the set of allowed 32-bit values. The masking
    > key needs to be unpredictable; thus, the masking key MUST be
    > derived from a strong source of entropy, and the masking key for a
    > given frame MUST NOT make it simple for a server/proxy to predict
    > the masking key for a subsequent frame. The unpredictability of
    > the masking key is essential to prevent authors of malicious
    > applications from selecting the bytes that appear on the wire.
    > RFC4086 discusses what entails a suitable source of entropy for
    > security-sensitive applications.