In order to satisfy the ObjectId generation spec, the native C extension uses arc4random if it is available, and falls back to using the stdlib rand function otherwise.

GitHub user midnight-wonderer suggested using Ruby's internal random utility instead, which is used to implement Ruby's SecureRandom module. It's worth taking a look, as this would make the ObjectId generation more spec-compliant.

The investigation could start here: https://github.com/ruby/ruby/blob/7380c7/internal/random.h . If the random implementation there meets our needs, it shouldn't be difficult to change the native extension to use it.