Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: We just had an actual UUID v4 collision...

news.ycombinator.com

Post reply on HN
Print view View original

331–340 of 369 posts

Re: Ask HN: We just had an actual UUID v4 collision...

#331

Post by wazoox »

This didn't happen to me... yet. Here's what I found 2 days ago deep in a production PHP codebase:

  private static function createUUID(){
   $md5 = md5(uniqid('', true));
   return substr($md5, 0, 8 ) . '-' .
    substr($md5, 8, 4) . '-' .
    substr($md5, 12, 4) . '-' .
    substr($md5, 16, 4) . '-' .
    substr($md5, 20, 12);
  }
Holy cow, how didn't this horror come and bite us in the juicy parts ? I don't know.

Re: Ask HN: We just had an actual UUID v4 collision...

#333

Post by clickety_clack »

taegee wrote: post #294
susam wrote: post #289

Earlier quoted context omitted.

And for people who like equations, here is my attempt at explaining it. Assume each flip is independent and the bias remains same in each flip. Let P(H) = p, P(T) = 1 - p. Then P(HH) = p^2, P(HT) = p(1 - p), P(TH) = (1 - p)p, P(TT) = (1 - p)^2. Therefore P(HT or TH) = 2p(1 - p). Now calculate P(HT | HT or TH) = p(1 - p) / (2p(1 - p)) = 1/2, P(TH | HT or TH) = (1 - p)p / (2p(1 - p)) = 1/2.

You don't need conditional probability here, as the flips are independent. It's just p(H)p(T). And p(H)p(T) = p(T)p(H), thus 2*p(H)p(T) = 2p(1-p).

That wasn’t what he was trying to prove, but the proof could be done without conditionals like this:

If: p(H)p(T) = p(T)p(H)

And: p(H)p(T) + p(T)p(H) = 1

Then: p(H)p(T) = p(T)p(H) = 0.5

Re: Ask HN: We just had an actual UUID v4 collision...

#334

Post by Melatonic »

bmitc wrote: post #298
LocalH wrote: post #141

Earlier quoted context omitted.

This is why CloudFlare has done what they did with the lava lamp wall. Not that the wall is such a great source of entropy on its own - I'm sure it's not their only source, but you can never have too many sources of entropy - but it makes it visible in a way that can grab those who don't fully understand the concepts of RNGs and how entropy plays into that. The more sources of entropy, the more closely you approach "…

> This is why CloudFlare has done what they did with the lava lamp wall. Interesting. I wonder how true it actually is that they use it like they claim here: https://www.cloudflare.com/learning/ssl/lava-lamp-encryption... . It's in one of their lobbies, so doesn't that make it susceptible to an attack in some way? I'm not knowledgeable enough to know, but I figured if they actually used that method, they'd have a mor…

It's probably just one of many sources. Just by being in one physical location it would be vulnerable to a network outage (ignoring any potential for attacks)

Re: Ask HN: We just had an actual UUID v4 collision...

#337

Post by MathMonkeyMan »

greiskul wrote: post #233
LocalH wrote: post #141

Earlier quoted context omitted.

This is why CloudFlare has done what they did with the lava lamp wall. Not that the wall is such a great source of entropy on its own - I'm sure it's not their only source, but you can never have too many sources of entropy - but it makes it visible in a way that can grab those who don't fully understand the concepts of RNGs and how entropy plays into that. The more sources of entropy, the more closely you approach "…

> you can never have too many sources of entropy This is so true. And the beauty is that with algorithms, we don't even need to know much about the entropy to be able to extract it. There is the Von Neumann method of generating an unbiased coin from a biased coin. Of throwing it twice, and checking if you got HT or TH. And completely discarding all HH or TT results. It doesn't matter if the coin you are using is 20%…

I remember hearing about an interview problem from a while back, and the trick was to use exclusive-or. Now I understand why.

Re: Ask HN: We just had an actual UUID v4 collision...

#338

Post by susam »

taegee wrote: post #294
susam wrote: post #289

Earlier quoted context omitted.

And for people who like equations, here is my attempt at explaining it. Assume each flip is independent and the bias remains same in each flip. Let P(H) = p, P(T) = 1 - p. Then P(HH) = p^2, P(HT) = p(1 - p), P(TH) = (1 - p)p, P(TT) = (1 - p)^2. Therefore P(HT or TH) = 2p(1 - p). Now calculate P(HT | HT or TH) = p(1 - p) / (2p(1 - p)) = 1/2, P(TH | HT or TH) = (1 - p)p / (2p(1 - p)) = 1/2.

You don't need conditional probability here, as the flips are independent. It's just p(H)p(T). And p(H)p(T) = p(T)p(H), thus 2*p(H)p(T) = 2p(1-p).

Independence tells us how to compute the probability of a sequence like HT or TH:

  P(HT) = P(H)P(T) = p(1 - p)
But the question I am addressing is not just "what is the probability of HT?" It is "given that the two flips are different, what is the probability that the order was HT rather than TH?"

That is a conditional probability:

  P(HT | HT or TH)

Re: Ask HN: We just had an actual UUID v4 collision...

#339

Post by owl57 »

_kst_ wrote: post #186

This reminds me of a passage from the book "Pro Git". https://git-scm.com/book/en/v2 > "Here’s an example to give you an idea of what it would take to get a SHA-1 collision. If all 6.5 billion humans on Earth were programming, and every second, each one was producing code that was the equivalent of the entire Linux kernel history (6.5 million Git objects) and pushing it into one enormous Git repository, it would take…

This idea of everyone producing absurd amounts of git objects is less fantastic now [1]. We're still far from these numbers, but an order of magnitude less far than last year [2].

Also an interesting bit of history here: apparently there was a time when people were already writing books on Git but "one enormous Git repository" wasn't yet the most common mode of using it.

[1] https://news.ycombinator.com/item?id=47932422

[2] https://x.com/kdaigle/status/2040164759836778878

Re: Ask HN: We just had an actual UUID v4 collision...

#340

Post by nxobject »

wpm wrote: post #274
BSVogler wrote: post #181

Earlier quoted context omitted.

I once read that noise of camera in total darkness is apparently a good source.

Would a CRT TV tuned to channel 3 and no RF input be a good source?

I imagine that there might still be a way to swing by with RF equipment and tip the scales in your favor. And if you're important enough, I'm sure there'll be someone motivatd enough to do this. After all, Polymarket was motivating enough for someone to take a hair dryer to a weather station...

https://www.theguardian.com/world/2026/apr/23/hairdryer-or-l...

Post reply on HN