3 ms·

If it can't be made stable, `git archive` should specifically add random content (under a feature flag to be removed after a year or two) to so as to make the g

If it can't be made stable, `git archive` should specifically add random content (under a feature flag to be removed after a year or two) to so as to make the generated checksum completely unreliable and force users to adopt different workflows.

dunham 4y ago
Randomly ordering the files, without adding random content, would do the trick.
nikonyrh 4y ago
Interesting idea, to make "undefined behavior" explicit.
astockwell 4y ago
Golang does this with hashmaps, it deliberately randomizes the keys’ order so that you can never depend on it. People hated it for a few months, but now it’s just another known idiom.
- ahrzb 4y ago
  That’s mainly for security reasons, mainly preventing Hash DDoS attacks, therefore a requirement.
- cpeterso 4y ago
  Hyrum’s Law applies, even when you take into account Hyrum’s Law. :) A story about a Golang program that had assumed map iteration was uniformly random but it’s not, which caused a load balancer to assign work unevenly: https://dev.to/wallyqs/gos-map-iteration-order-is-not-that-random-mag https://dev.to/wallyqs/gos-map-iteration-order-is-not-that-r... A graph of the map iteration order’s distribution showing that it’s not uniformly random: https://twitter.com/cafxx/status/1135190309514620928 https://twitter.com/cafxx/status/1135190309514620928
  - 0xjnml 4y ago
    From the language specification: "The iteration order over maps is not specified and is not guaranteed to be the same from one iteration to the next." There's a long shot between "not specified" and "uniformly random".
    - pwdisswordfishc 4y ago
      The joke is that the sort of people who rely on apparent behaviour in practice isn’t the sort that tends to look things up in specifications.
  - akkartik 4y ago
    Ok, you win, have a favorite.
- ilyt 4y ago
  Perl did that too IIRC, although motivation was to avoid predictable hash collisions that might put program into slow path
  - usr1106 4y ago
    Didn't Python introduce that, too, after a high profile DoS CVE around 10 years ago?
    - jwilk 4y ago
      Yes. https://docs.python.org/3/reference/datamodel.html#object.__hash__ https://docs.python.org/3/reference/datamodel.html#object.__... > Changed in version 3.3: Hash randomization is enabled by default. But since Python 3.6 dicts keep the insertion order, so the order of iteration is deterministic again.

dunham 4y ago

Randomly ordering the files, without adding random content, would do the trick.

nikonyrh 4y ago

Interesting idea, to make "undefined behavior" explicit.

astockwell 4y ago

Golang does this with hashmaps, it deliberately randomizes the keys’ order so that you can never depend on it. People hated it for a few months, but now it’s just another known idiom.

ahrzb 4y ago
That’s mainly for security reasons, mainly preventing Hash DDoS attacks, therefore a requirement.
cpeterso 4y ago
Hyrum’s Law applies, even when you take into account Hyrum’s Law. :) A story about a Golang program that had assumed map iteration was uniformly random but it’s not, which caused a load balancer to assign work unevenly: https://dev.to/wallyqs/gos-map-iteration-order-is-not-that-random-mag https://dev.to/wallyqs/gos-map-iteration-order-is-not-that-r... A graph of the map iteration order’s distribution showing that it’s not uniformly random: https://twitter.com/cafxx/status/1135190309514620928 https://twitter.com/cafxx/status/1135190309514620928
- 0xjnml 4y ago
  From the language specification: "The iteration order over maps is not specified and is not guaranteed to be the same from one iteration to the next." There's a long shot between "not specified" and "uniformly random".
  - pwdisswordfishc 4y ago
    The joke is that the sort of people who rely on apparent behaviour in practice isn’t the sort that tends to look things up in specifications.
- akkartik 4y ago
  Ok, you win, have a favorite.
ilyt 4y ago
Perl did that too IIRC, although motivation was to avoid predictable hash collisions that might put program into slow path
- usr1106 4y ago
  Didn't Python introduce that, too, after a high profile DoS CVE around 10 years ago?
  - jwilk 4y ago
    Yes. https://docs.python.org/3/reference/datamodel.html#object.__hash__ https://docs.python.org/3/reference/datamodel.html#object.__... > Changed in version 3.3: Hash randomization is enabled by default. But since Python 3.6 dicts keep the insertion order, so the order of iteration is deterministic again.