Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: We just had an actual UUID v4 collision...

news.ycombinator.com

Post reply on HN
Print view View original

91–100 of 369 posts

Re: Ask HN: We just had an actual UUID v4 collision...

#91

Post by kayodelycaon »

beardyw wrote: post #64
mittermayr wrote: post #7

Earlier quoted context omitted.

yeah, any sort of additional semi-random data could've helped prevent this, I'm sure. That, however, is also kind of the idea of UUIDv4, it has lots of randomness and time built in already.

But surely hashing the date still allows for a future collision. Leaving the date as is means it will never collide after that one second has passed.

UUID 7 does not hash the date. It uses 48 bits to store a millisecond resolution timestamp. This allows you to sort uuids by time.

Re: Ask HN: We just had an actual UUID v4 collision...

#92

Post by Onavo »

Hizonner wrote: post #78
juancn wrote: post #77

Something off on how the RNG is initialized? Lack of entropy? If the rng is not customized it will use: const rnds8 = new Uint8Array(16); export default function rng() { return crypto.getRandomValues(rnds8); } getRandomValues doesn't specify a minimum amount of entropy.

It's a near certainty that something is badly wrong with the RNG, and, yes, probably in how it's seeded. It's probably messing up the cryptography, too.

But defaults should be sane and safe. RNG isn't the sort of thing you want to be messing up. Every JS dev was taught that Math.random is not safe by default, but the crypto package is.

Re: Ask HN: We just had an actual UUID v4 collision...

#93

Post by jaccola »

k4rli wrote: post #72
serf wrote: post #3

1 in 4.72 × 10²⁸ 1 in 47.3 octillion. i'd be suspecting a race condition or some other naive mistake, otherwise id be stocking up on lottery tickets. (lol at the other user posting at the same time about the lottery ticket.. great minds and all that.)

The lottery ticket part makes no sense. Statistically if such an improbable event just happened to him, then chance of it happening again should be even more improbable.

The chance of him winning the lottery is identical to before, however the reward if he wins is slightly greater.

He would win the lottery money + he gets to tell people who don’t understand independence this incredible story!

Re: Ask HN: We just had an actual UUID v4 collision...

#94

Post by sowbug »

k4rli wrote: post #72
serf wrote: post #3

1 in 4.72 × 10²⁸ 1 in 47.3 octillion. i'd be suspecting a race condition or some other naive mistake, otherwise id be stocking up on lottery tickets. (lol at the other user posting at the same time about the lottery ticket.. great minds and all that.)

The lottery ticket part makes no sense. Statistically if such an improbable event just happened to him, then chance of it happening again should be even more improbable.

This is probably (ha) a troll thread, but in case anyone here is among today's lucky (ha) 10,000, https://en.wikipedia.org/wiki/Independence_(probability_theo...

Re: Ask HN: We just had an actual UUID v4 collision...

#95

Post by jandrewrogers »

This is surprisingly common.

The security of UUIDv4 is based on the assumption of a high-quality entropy source. This assumption is invalidated by hardware defects, normal software bugs, and developers not understanding what "high-quality entropy" actually means and that it is required for UUIDv4 to work as advertised.

It is relatively expensive to detect when an entropy source is broken, so almost no one ever does. They find out when a collision happens, like you just did.

UUIDv4 is explicitly forbidden for a lot of high-assurance and high-reliability software systems for this reason.

Re: Ask HN: We just had an actual UUID v4 collision...

#96

Post by throw0101c »

wongarsu wrote: post #68
throwaway_19sz wrote: post #50

Funny story no one will believe, but it’s true. A good friend of mine joined a startup as CTO 10 years ago, high growth phase, maybe 200 devs… In his first week he discovered the company had a microservice for generating new UUIDs. One endpoint with its own dedicated team of 3 engineers …including a database guy (the plot thickens). Other teams were instructed to call this service every time they needed a new ‘safe’…

At some point someone optimizes the system to a global company-wide incrementing 128 bit counter. Instead of needing a costly database lookup against a growing database the microservice just fetches the current counter, increments it by one and hands out the new value. Easy, fast O(1) operation. This even allows you to shard the service to provide high availability and distribute the service globally to reduce latenc…

> At some point someone optimizes the system to a global company-wide incrementing 128 bit counter.

Some UUID versions include time, so there's a bit of a counter in that.

Re: Ask HN: We just had an actual UUID v4 collision...

#97

Post by sheept »

wongarsu wrote: post #68
throwaway_19sz wrote: post #50

Funny story no one will believe, but it’s true. A good friend of mine joined a startup as CTO 10 years ago, high growth phase, maybe 200 devs… In his first week he discovered the company had a microservice for generating new UUIDs. One endpoint with its own dedicated team of 3 engineers …including a database guy (the plot thickens). Other teams were instructed to call this service every time they needed a new ‘safe’…

At some point someone optimizes the system to a global company-wide incrementing 128 bit counter. Instead of needing a costly database lookup against a growing database the microservice just fetches the current counter, increments it by one and hands out the new value. Easy, fast O(1) operation. This even allows you to shard the service to provide high availability and distribute the service globally to reduce latenc…

Twitter snowflakes haven't changed. Most of the bits go to the timestamp, which I guess is a global incrementing counter as you described

Re: Ask HN: We just had an actual UUID v4 collision...

#98

Post by [deleted] »

rich_sasha wrote: post #62
jordiburgos wrote: post #11

Please, do not use b6133fd6-70fe-4fe3-bed6-8ca8fc9386cd, I checked my database and I was using it already.

I always thought generating UUIDs at random was insane. I now only use LLMs. The prompt is: "generate a UUID. Make sure no one ever used it anywhere in their code or database. Check your work and think hard about each step. Do not output any reasoning or plain English, only th UUID itself". You're welcome.

[deleted]

Re: Ask HN: We just had an actual UUID v4 collision...

#99

Post by throw0101c »

delichon wrote: post #67
adyavanapalli wrote: post #21

What you're talking about is so extremely rare that it's much more likely that the entire Earth is destroyed by an asteroid right this inst...

About as rare as an asteroid typing an ellipsis and clicking the add comment button.

Well, this joke dates back to (at least) the dial-up days where {#`%${%&`+'${`%& NO CARRIER
Post reply on HN