Is this JS library using openssl genrsa -rand improperly? pem, a JS wrapper around openssl, has the following code in it:

var params = ['genrsa',
    '-rand',
    '/var/log/mail:/var/log/messages',
    keyBitsize
];


Am I correct in thinking that that is an improper usage of the -rand option (poor entropy = bad seed for random number generator)?

Cause this dude just closed the issue thinking it's OK, and if he's wrong, it'd be nice if someone could explain in better detail than I can why what he is doing is unsafe.

If I'm mistaken and it is safe, I'd be curious to hear why.

Thanks Cryptography StackExchange!
I ran the command under dtruss on OSX, with it pointing to a static file. Even then, it appears to use this as an additional source of randomness to /dev/urandom.

It's distasteful and almost certainly pointless. But assuming it only mixes the data into an already cryptographically-secure source of randomness, it's not actively harmful. That said, I can only see the syscalls being made — it's possible this is not what's happening at all under the hood.