"Use /dev/random instead of /dev/urandom" about libsodium

[tarcieri]

You are incorrect. Please see this paper: "Security Analysis of Pseudo-Random Number Generators with Input:
/dev/random is not Robust"

http://eprint.iacr.org/2013/338.pdf

Rather, it is /dev/random that does not provide secure, cross-platform guarantees about cryptographically random numbers. Using a cryptographically secure PRNG, like the kind provided by /dev/urandom on most platforms, seeded by platform-specific true random number generators is sufficient to produce random numbers that mask underlying biases. Additionally since /dev/random blocks it opens itself up to timing side channels on entropy collection.

The Debian problem you refer to was actually due to them commenting out a line from their random number generation routine after getting confused about a warning from Valgrind. It has nothing to do with /dev/random vs /dev/urandom