In my response to my question ["what does the letter 'u' mean in /dev/urandom?"](https://unix.stackexchange.com/q/323610/143394) the [myths about /dev/urandom](http://www.2uo.de/myths-about-urandom/)
page was posted in two comments and an answer.

The [myths about /dev/urandom](http://www.2uo.de/myths-about-urandom/) page is trying to steer people heavily into using `/dev/urandom` over `dev/random`.

This guy knows more than I do, so it would be easy for me to nod and accept, but I'd like to post it here so that other people who also know more than I do could comment.

What irks me about [myths about /dev/urandom](http://www.2uo.de/myths-about-urandom/) is that:

* The two devices still have a differing behaviour depending on the size of the entropy pool
* There are no use cases given where `/dev/random` is the better choice (which seems unbalanced)

I note that `cryptsetup` has an option `--use-random`:

> 
> NOTES ON RANDOM NUMBER GENERATORS 
> 
> 
> Using /dev/random on a system without enough
>  entropy sources can cause luksFormat to block until the requested
>  amount of random data is gathered. In a low-entropy situation (embedded
>  system), this can take a very long time and potentially forever. At the
>  same time, using /dev/urandom in a low-entropy situation will produce
>  low-quality keys. This is a serious problem, but solving it is out of
>  scope for a mere man-page. See urandom(4) for more information.
> 
> 
> 

So my question is:

**In which practical situations would one want to use `/dev/random` in preference to `/dev/urandom`, and why?**