fortuna

They need to adopt something like Fortuna or one of the more modern formalisms of Fortuna.

This is the whole motivation behind Bruce Schneier and Niels Ferguson developing the Fortuna algorithm.

Best bet is to use many entropy sources including local hardware (ie sound card audio input) mixed in a fortuna entropy pool.

It corrects a couple of (not very large) errors in the paper that introduced Fortuna and presents a modified version that does better.

Much of the Fortuna design is concerned with accumulating and using entropy effectively - there's more to it than just the random output generator.

Most things have spoiled O Fortuna for me (though I've never watched the X Factor).

None of that makes either Schneier or Fortuna look substantially bad.

This reminds me, in my undergraduate I implemented Fortuna in C and used it for a project in my statistics class.

Interestingly, the way Fortuna works seems to me would also somewhat mitigate the kind of attack DJB talks about in the article referenced by OP[1].

The X Factor really spoiled O Fortuna for me.

Note that the paper doesn't say Fortuna is worthless against compromised state; just that optimization techniques can be used to build an RNG that handles the problem better.

Right now the entropy in Xen domains is weak, but we are working with the rest of the team to feed some actual environmental noise to keep Fortuna well-fed.

It describes the key idea in Yarrow and Fortuna as "simple but brilliant", and finds that Fortuna does its job rather well.

My favorite (since high school latin) has been, "Fortes fortuna iuvat" (Fortune favors the brave).

No -- dealing with the "premature next" problem was a key design goal of Fortuna, and it did it rather well.

Fortuna as option, and slated for being made the default later.

With Fortuna, you don't know how long it will take to recover from state compromise (since it's difficult to reliably estimate entropy), but you know it eventually will happen.