uses random(), not rand()