linsomniac/bottlesession — Issue #1: Possible predictable secrets
Author: FedericoCeratto
Created: 2012-03-06 13:04:19+00:00
State: open

uuid1, /proc/uptime and sha1() are being used to generate a secret.
uuids are not meant to be cryptograpically secure, /proc/uptime is predictable and therefore its sha1()

Please consider using /dev/urandom - it's there for a reason ;)