Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: We just had an actual UUID v4 collision...

news.ycombinator.com

Post reply on HN
Print view View original

221–230 of 369 posts

Re: Ask HN: We just had an actual UUID v4 collision...

#221

Post by dheera »

LocalH wrote: post #141
jandrewrogers wrote: post #95

This is surprisingly common. The security of UUIDv4 is based on the assumption of a high-quality entropy source. This assumption is invalidated by hardware defects, normal software bugs, and developers not understanding what "high-quality entropy" actually means and that it is required for UUIDv4 to work as advertised. It is relatively expensive to detect when an entropy source is broken, so almost no one ever does.…

This is why CloudFlare has done what they did with the lava lamp wall. Not that the wall is such a great source of entropy on its own - I'm sure it's not their only source, but you can never have too many sources of entropy - but it makes it visible in a way that can grab those who don't fully understand the concepts of RNGs and how entropy plays into that. The more sources of entropy, the more closely you approach "…

The lava lamps are just for show.

You can get entropy just by plugging an oscilloscope into a pile of dirt and cranking the gain up.

Re: Ask HN: We just had an actual UUID v4 collision...

#222

Post by ipaddr »

dweez wrote: post #103

Good moment to revisit this fun article: https://jasonfantl.com/posts/Universal-Unique-IDs/ If the entire universe were turned into a giant computer and did nothing but generate uuids until its heat death, how many bits would you need for the ID space?

"But are you worried that every human on Earth will be hit by a meteorite right now? That probability is also non-zero, yet it is so infinitesimally small that we treat it as an impossibility."

This might be a bad example because one meteorite could take out the world and given enough time is likely to.

Re: Ask HN: We just had an actual UUID v4 collision...

#223

Post by 8organicbits »

I wrote about real world collisions, including that particular library last year (https://alexsci.com/blog/uuid-oops/).

There are a bunch of constraints that must be strictly held for UUIDs to be collision resistant, I'd guess there is a problem with your random number generator.

Re: Ask HN: We just had an actual UUID v4 collision...

#224

Post by jbverschoor »

toraway wrote: post #178
jbverschoor wrote: post #117

Earlier quoted context omitted.

Didn't actually want to write a test myself.. but I miss Claudia confirmed it. Pretty concearning. Synchronous / serial calls: import rng from './rng'; const a = rng(); console.log('a after first call: ', Array.from(a)); const b = rng(); console.log('a after second call:', Array.from(a)); console.log('b after second call:', Array.from(b)); console.log('a === b (same reference)? ', a === b); console.log('a equals b (s…

Shouldn't your test follow the pattern of how rng() is actually being used in the uuid.ts code internally? Your test is more-or-less contrived to fail given the tradeoff to avoid repeated memory allocations but that doesn't say much about the actual usage in uuid generation since it's not exported for general purpose use. Presumably they had some hot path somewhere where rng() is called in a loop and this optimizatio…

I don't believe so. Sure it's not an issue after some checks, but it's very easy to shoot yourself in the foot like that. I get the micro-optimization for the allocation.. But it's not clear / documented. At the minimum, the function should be renamed to reflect the inner workings.

The function is a module, and it doesn't do what you'd expect.

Re: Ask HN: We just had an actual UUID v4 collision...

#225

Post by throw-the-towel »

euroderf wrote: post #177
victorbjorklund wrote: post #166

Earlier quoted context omitted.

If I understand it the Lava lamps are 90% PR/fun. They have a lot of other sources for entropy that scales better.

Ant farm ? Hamster wheels ? Anything critter-driven should provide some entropy.

Speaking of ants, Fourmilab (i.e. John Walker, of Autodesk fame) used to provide a random number generator powered by background radiation: https://www.fourmilab.ch/hotbits/

Re: Ask HN: We just had an actual UUID v4 collision...

#226

Post by adrian_b »

dheera wrote: post #221
LocalH wrote: post #141

Earlier quoted context omitted.

This is why CloudFlare has done what they did with the lava lamp wall. Not that the wall is such a great source of entropy on its own - I'm sure it's not their only source, but you can never have too many sources of entropy - but it makes it visible in a way that can grab those who don't fully understand the concepts of RNGs and how entropy plays into that. The more sources of entropy, the more closely you approach "…

The lava lamps are just for show. You can get entropy just by plugging an oscilloscope into a pile of dirt and cranking the gain up.

Any high-gain amplifier can be used, with its input connected to a resistor or a diode.

For instance you can use the microphone input of a PC, together with an additional external amplifier made with an audio amplifier integrated circuit or an operational amplifier integrated circuit and with a diode or a resistor at its input. The microphone input of PCs provides a 5 V voltage that can be sufficient as a power supply for a noise source plugged in it.

Such a true RNG can be made on a small PCB with an audio jack, so you can plug it into any PC with microphone input and have a true RNG that you can trust better than the RNG included in modern Intel and AMD CPUs. In the past, many AMD CPUs had defective internal RNGs. Moreover, both for Intel and for AMD it is impossible to verify whether the internal RNG does what it claims to do or it generates predictable pseudo-random numbers.

Re: Ask HN: We just had an actual UUID v4 collision...

#227

Post by TacticalCoder »

_kst_ wrote: post #186

This reminds me of a passage from the book "Pro Git". https://git-scm.com/book/en/v2 > "Here’s an example to give you an idea of what it would take to get a SHA-1 collision. If all 6.5 billion humans on Earth were programming, and every second, each one was producing code that was the equivalent of the entire Linux kernel history (6.5 million Git objects) and pushing it into one enormous Git repository, it would take…

Hasn't the Git team been hard at work to optionally offer other hashes, like SHA256, in addition to SHA-1?

Re: Ask HN: We just had an actual UUID v4 collision...

#229

Post by adzm »

beejiu wrote: post #153

Are your UUIDs generated client side or server side? If it's client side, it could be due to a crawling bot. Googlebot for example executes Javascript using deterministic "randomness".

Googlebot's lack of randomness was the conclusion of a previous incident for that package https://github.com/uuidjs/uuid/issues/546
Post reply on HN