True Randomness in Laravel with Lararand

Dealing cards from a tarot deck using PHP can lead to biased results due to the way random_bytes() produces numbers. The issue arises because a byte holds 256 values, while a deck has 78 cards. The largest multiple of 78 that fits into 256 is 234 (78 × 3), leaving 22 values that wrap around and appear four times instead of three. This causes 22 cards to show up 33% more often than the other 56 cards.

Tests that check for the correct range pass, even though the distribution reveals the bias. To fix this, rejection sampling can be used: discard the bytes that land in the uneven tail and draw again. This ensures each card has an equal chance of appearing. This fix should be implemented once in a codebase rather than in every function that turns bytes into numbers.

The same modulo bias problem applies to shuffling arrays. The incorrect method of swapping each position with any other position leads to some permutations being more frequent than others. The correct approach is to swap each position with another position at or below the current one, which avoids the modulo bias.

For applications where the randomness is essential, such as lottery draws or regulated processes, a reliable solution is crucial. Instead of relying on the built-in random_int, a package like lararand can be used. This package allows the use of multiple randomness sources, such as quantum vacuum noise, atmospheric noise, or the system CSPRNG.

The sources are tried left to right, and the first one that provides valid bytes is used. This approach ensures the randomness is not compromised and visible in the configuration file for easy review and adjustment.