5 ms·

If you want a random entry from an array, Math.random is fine. Anyone who doesn't know that prng's are broken for things like uuids shouldn't be in charge.

seanwilson 11y ago
There's something to be said about having sensible defaults that prevent common mistakes though. Everyone makes mistakes.
- baudehlo 11y ago
  True. But every language has gone through this issue. Node is particularly vulnerable to weak prng seeding due to relying on forking to support multiple processes. Am I that old and grumpy to expect people to be aware of the history here?
  - seanwilson 11y ago
    I think the size of this thread as well as the existence of blog posts like this means it's a mistake that's always going to be repeated. There's way too many programming gotchas to expect people to keep track of them all. Language support to avoid classes of mistakes is a great idea to me e.g. such as having a good random algorithm by default and a UUID library.
johncolanduoni 11y ago
> Anyone who doesn't know that prng's are broken for things like uuids shouldn't be in charge. Depends on how you're using them. If you only care about collisions, and you're not worried about an attacker trying to manipulate your system, then using a PRNG whose output is well-distributed (read: not necessarily a language's random function) is fine. The problem is most language's default PRNGs are complete crap :( edit: grammar
kalleboo 11y ago
The bug report that prompted V8 to fix their Math.random was someone doing A/B testing on their site by checking Math.random()>0.5, and the V8 PRNG was so bad that it would give a consistent 2-3% error, which would make any results useless. Seems like V8's Math.random was only fine for extremely trivial cases (Google doodle Pacman I guess). Meanwhile Webkit has been using a CSPRNG and nobody seems to be complaining.
- mike_hearn 11y ago
  Yeah - the thing I was thinking throughout the article was .... this is all interesting, but isn't it an obvious consequence of using a runtime designed for more quickly loading the Gmail UI on the server side? I went and checked the docs for the Java Math.random() function and it clearly specifies the algorithm and doesn't have the same issue. V8 is a great piece of work but it was never intended for anything beyond speeding up web pages. Why are people using node.js on the server side at all, when there are more industrial strength runtimes with better performance available?
mmalone 11y ago
If you want to do something as trivial as an unbiased Fisher-Yates shuffle of an array, however, Math.random() is broken. And Math.random() doesn't have to be broken for things like UUIDs. Python and Ruby both have PRNGs that are suitable for such things. We fucked up by not vetting the algorithm, that's definitely the primary lesson here. Mea culpa. I'm sure you would have done things differently, but V8 is a modern system and I don't think assuming a modern PRNG was completely unreasonable while quickly getting to MVP at a new startup.
- notzorbo2 11y ago
  You seem to be getting a lot of flack from people with 20-20 hindsight. For what it's worth, I have made the exact same assumptions you have when generating internal unique IDs in a distributed system purely for tracking purposes. The only difference was that mine was in Python and I got lucky that its random implementation uses a mersenne twister.
- PhantomGremlin 11y ago
  We fucked up by not vetting the algorithm, that's definitely the primary lesson here. Mea culpa. Bingo. Exactly. I heavily criticized you in another post for 1) your initial choice of substandard algorithm and 2) your rationalizations (e.g. Google's "good reputation"). But that is ancient history. Here you're admitting that you fucked up, which IMO you didn't admit previously. Also, kudos for your article which kicked off this entire discussion. In that article you showed that you carefully analyzed what was happening, how you went wrong, and how you could improve. Even more important, you did this all publicly, both your article and your responses here on HN. Everyone learns from this. I commend you for your openness.
  - Dylan16807 11y ago
    Well Google fucked up too, in a way that affects many more people. They used a broken form of an obsolete random number generator with a 2^30 cycle. There are faster and simpler generators that perform overwhelmingly better on statistical tests.

seanwilson 11y ago

There's something to be said about having sensible defaults that prevent common mistakes though. Everyone makes mistakes.

baudehlo 11y ago
True. But every language has gone through this issue. Node is particularly vulnerable to weak prng seeding due to relying on forking to support multiple processes. Am I that old and grumpy to expect people to be aware of the history here?
- seanwilson 11y ago
  I think the size of this thread as well as the existence of blog posts like this means it's a mistake that's always going to be repeated. There's way too many programming gotchas to expect people to keep track of them all. Language support to avoid classes of mistakes is a great idea to me e.g. such as having a good random algorithm by default and a UUID library.

johncolanduoni 11y ago

> Anyone who doesn't know that prng's are broken for things like uuids shouldn't be in charge. Depends on how you're using them. If you only care about collisions, and you're not worried about an attacker trying to manipulate your system, then using a PRNG whose output is well-distributed (read: not necessarily a language's random function) is fine. The problem is most language's default PRNGs are complete crap :( edit: grammar

kalleboo 11y ago

The bug report that prompted V8 to fix their Math.random was someone doing A/B testing on their site by checking Math.random()>0.5, and the V8 PRNG was so bad that it would give a consistent 2-3% error, which would make any results useless. Seems like V8's Math.random was only fine for extremely trivial cases (Google doodle Pacman I guess). Meanwhile Webkit has been using a CSPRNG and nobody seems to be complaining.

mike_hearn 11y ago
Yeah - the thing I was thinking throughout the article was .... this is all interesting, but isn't it an obvious consequence of using a runtime designed for more quickly loading the Gmail UI on the server side? I went and checked the docs for the Java Math.random() function and it clearly specifies the algorithm and doesn't have the same issue. V8 is a great piece of work but it was never intended for anything beyond speeding up web pages. Why are people using node.js on the server side at all, when there are more industrial strength runtimes with better performance available?

mmalone 11y ago

If you want to do something as trivial as an unbiased Fisher-Yates shuffle of an array, however, Math.random() is broken. And Math.random() doesn't have to be broken for things like UUIDs. Python and Ruby both have PRNGs that are suitable for such things. We fucked up by not vetting the algorithm, that's definitely the primary lesson here. Mea culpa. I'm sure you would have done things differently, but V8 is a modern system and I don't think assuming a modern PRNG was completely unreasonable while quickly getting to MVP at a new startup.

notzorbo2 11y ago
You seem to be getting a lot of flack from people with 20-20 hindsight. For what it's worth, I have made the exact same assumptions you have when generating internal unique IDs in a distributed system purely for tracking purposes. The only difference was that mine was in Python and I got lucky that its random implementation uses a mersenne twister.
PhantomGremlin 11y ago
We fucked up by not vetting the algorithm, that's definitely the primary lesson here. Mea culpa. Bingo. Exactly. I heavily criticized you in another post for 1) your initial choice of substandard algorithm and 2) your rationalizations (e.g. Google's "good reputation"). But that is ancient history. Here you're admitting that you fucked up, which IMO you didn't admit previously. Also, kudos for your article which kicked off this entire discussion. In that article you showed that you carefully analyzed what was happening, how you went wrong, and how you could improve. Even more important, you did this all publicly, both your article and your responses here on HN. Everyone learns from this. I commend you for your openness.
- Dylan16807 11y ago
  Well Google fucked up too, in a way that affects many more people. They used a broken form of an obsolete random number generator with a 2^30 cycle. There are faster and simpler generators that perform overwhelmingly better on statistical tests.