Three mistakes from Dart/Flutter's weak PRNG

robin_reala wrote: post #3

I’m not a Dart fan so maybe I’m biased, but wow this (from the article) is a failure on many levels: https://github.com/dart-lang/sdk/issues/56609

From the code in the issue

    // TODO: Make this actually random 
    static int _initialSeed() => 0xCAFEBABEDEADBEEF;

Oops.

Re: Three mistakes from Dart/Flutter's weak PRNG

#5

Post by sksrbWgbfK » Fri, Dec 13, 2024, 3:29 PM UTC

bsimpson wrote: post #2

[flagged]

I expect readers of HN to know the acronym PRNG, and that random must be seeded all the time and must NOT be used for secure things. But we're living in the age of LLMs that create perfect code while programmers know nothing anymore.

Re: Three mistakes from Dart/Flutter's weak PRNG

#6

Post by lann » Fri, Dec 13, 2024, 3:32 PM UTC

sksrbWgbfK wrote: post #5

bsimpson wrote: post #2

[flagged]

I expect readers of HN to know the acronym PRNG, and that random must be seeded all the time and must NOT be used for secure things. But we're living in the age of LLMs that create perfect code while programmers know nothing anymore.

This comment really assumes you know the acronym LLM

Re: Three mistakes from Dart/Flutter's weak PRNG

#7

Post by high_priest » Fri, Dec 13, 2024, 3:33 PM UTC

sksrbWgbfK wrote: post #5

bsimpson wrote: post #2

[flagged]

I expect readers of HN to know the acronym PRNG, and that random must be seeded all the time and must NOT be used for secure things. But we're living in the age of LLMs that create perfect code while programmers know nothing anymore.

Are PRNG the letters on an automatic transmission stick?

Re: Three mistakes from Dart/Flutter's weak PRNG

#8

Post by busterarm » Fri, Dec 13, 2024, 3:34 PM UTC

bsimpson wrote: post #2

[flagged]

Or that you have a web browser with search capabilities that you're likely to use before complaining about acronyms...

The term is table stakes for the audience this is written for.

Re: Three mistakes from Dart/Flutter's weak PRNG

#9

Post by firefax » Fri, Dec 13, 2024, 3:37 PM UTC

bsimpson wrote: post #2

[flagged]

>The article really assumes you know the acronym PNRG

Why would you be reading this article if you do not?

This is the type of critique given when writing for a general audience, not a scientific whitepaper.

(Fun fact: The AP style guide tells folks to write at an 8th grade level because that's reading level of the average American adult. 8th graders do not read white papers on cryptographic design, and when they do, they look up unknown acronyms just like big boys and girls do.)

Re: Three mistakes from Dart/Flutter's weak PRNG

#10

Post by klooney » Fri, Dec 13, 2024, 3:38 PM UTC

New languages should make sure the default random() is cryptographically secure, and hide PRNGs behind weakrandom() or repeatablerandom() or something. Safe and slow defaults are better than fast and unsafe.