Were the chances than an npm package is crap factored in?
Ask HN: We just had an actual UUID v4 collision...
211–220 of 369 posts
Re: Ask HN: We just had an actual UUID v4 collision...
#212Earlier quoted context omitted.
I left a more detailed comment on the parent, but it's definitely not impossible!
The scenario in this post is that the first uuid was created one year before the duplicate uuid. That isn’t possible with v7
The scenario being the collision itself, the time period isn’t particularly relevant aside from it occurring much quicker than expected.
Re: Ask HN: We just had an actual UUID v4 collision...
#213Funny story no one will believe, but it’s true. A good friend of mine joined a startup as CTO 10 years ago, high growth phase, maybe 200 devs… In his first week he discovered the company had a microservice for generating new UUIDs. One endpoint with its own dedicated team of 3 engineers …including a database guy (the plot thickens). Other teams were instructed to call this service every time they needed a new ‘safe’…
I've seen similar, buried deep within a major SV tech co. Their process was a bit more complex because the master list of in-use UUIDs was stored in an external CMDB service run by a different department. They got a daily dump of that db, so were able to check that when generating a "provisional" id. Only once it had been properly submitted to the CMDB did it became "confirmed". They had guardrails in place to preven…
They should upgrade to Zookeeper II: Zookeepier.
Re: Ask HN: We just had an actual UUID v4 collision...
#214Earlier quoted context omitted.
This is why CloudFlare has done what they did with the lava lamp wall. Not that the wall is such a great source of entropy on its own - I'm sure it's not their only source, but you can never have too many sources of entropy - but it makes it visible in a way that can grab those who don't fully understand the concepts of RNGs and how entropy plays into that. The more sources of entropy, the more closely you approach "…
If I understand it the Lava lamps are 90% PR/fun. They have a lot of other sources for entropy that scales better.
Yes, they also have wave machines, pendulums, and mobiles :)
https://blog.cloudflare.com/harnessing-office-chaos/
https://blog.cloudflare.com/chaos-in-cloudflare-lisbon-offic...
Re: Ask HN: We just had an actual UUID v4 collision...
#215> I thought this is technically impossible, and it will never happen
I always hated this meme/mindset, because if you dig in to the history of them you'll see that their original purpose was to collide. They were labels to identify messages in Apollo's distributed computing architecture. UID and later UUIDs were a reversible way to mark an intersection point between two dimensions.
Any two nodes in a distributed system would generate the same UID/UUID for the same two inputs, and a recipient of an identified message could reverse the identifier back into the original components. They were designed as labels for ephemeral messages so the two dimensions were time and hardware ID (originally Apollo serial number, later 802.3 hwaddress etc).
I think a lot of the confusion can be traced to the very earliest AEGIS implementation where the Apollo engineers started using “canned” (their term, i.e. static or well-known) UIDs to identify filesystems. Over time the popular usage of UUID fully shifted from ephemeral identifiers where duplicates were intentional toward canned identifiers where duplicates were unwanted and the two dimensions were random-and-also-random.
Re: Ask HN: We just had an actual UUID v4 collision...
#216Earlier quoted context omitted.
If I understand it the Lava lamps are 90% PR/fun. They have a lot of other sources for entropy that scales better.
Ant farm ? Hamster wheels ? Anything critter-driven should provide some entropy.
https://www.random.org/ Uses atmospheric noise. These dudes use dice?
https://youtube.com/shorts/ncoDq5EcPFg?si=lI6f9cw8dWcaDZ4Y
Re: Ask HN: We just had an actual UUID v4 collision...
#217Just a stupid question, but why not append the date, even in seconds as hex. It's just a few bytes and would guarantee that everything OK now will be OK in the future?
Might as well just use uuidv7
But since the randomness is obviously borked, it was much better to use v4 and find out about it after just 15K records instead of X million records later.
Re: Ask HN: We just had an actual UUID v4 collision...
#218Earlier quoted context omitted.
> One endpoint with its own dedicated team of 3 engineers > The team had its own kanban board and sprints. My early jobs were at startups startups with limited resources. Every decision to build something or hire someone was carefully made after much consideration. This story would have looked like fiction to me at the time. Later in my career I joined a startup like this where every new concern someone could think u…
> My early jobs were at startups startups with limited resources. Every decision to build something or hire someone was carefully made after much consideration. This story would have looked like fiction to me at the time. This was pre-2015 > Later in my career I joined a startup like this where every new concern someone could think up turned into a new microservice with new hires to form a new team. It didn't matter…
Ah, the heady days when we shipped a new AWS service with a team of 40, and when I came into work the next day we had 120 people and 80 of them were just inventing work out of whole cloth…
Re: Ask HN: We just had an actual UUID v4 collision...
#219> technically impossible Not at all! Just very unlikely. It's about odds and statistics. Not physics.
This undersells the word unlikely. It is very, very, very, very unlikely.
Re: Ask HN: We just had an actual UUID v4 collision...
#220This reminds me of a passage from the book "Pro Git". https://git-scm.com/book/en/v2 > "Here’s an example to give you an idea of what it would take to get a SHA-1 collision. If all 6.5 billion humans on Earth were programming, and every second, each one was producing code that was the equivalent of the entire Linux kernel history (6.5 million Git objects) and pushing it into one enormous Git repository, it would take…
On the other hand, it turns out that pre-image attacks are quite feasible, and as several people who have thoughtlessly committed the pre-image attack test case files to git can attest… quite problematic