Comment by pixelbeat

FWIW GNU coreutils' shuf uses reservoir sampling for larger inputs to give bounded memory operation