3 ms·

>as reliable a source of randomness as the system as the system could give you directly Not sure what you mean by this. Which system?

by yura 3y ago

gumby 3y ago
I thought that was the point GP’s comment is making, but a reply to a parallel comment to yours suggests otherwise.
fragmede 3y ago
The combination of the operating system (Linux/MacOS/Windows) and the particular hardware it has access to. With different hardware, /dev/(u)random has different qualities of entropy.
- masklinn 3y ago
  JS’s Math.random is not a system (or CS) RNG, and a few years back it was barely an RNG at all: https://medium.com/@betable/tifu-by-using-math-random-f1c308c4fd9d# https://medium.com/@betable/tifu-by-using-math-random-f1c308... So no, Math.random is very much not > as reliable a source of randomness as the system
  - adgjlsfhk1 3y ago
    that's horrifying. I do slightly disagree with the final thoughts and works say that one of the xoshiro 256 generators is probably better than the 1024 ones. 256 bits of state is plenty to give you a longer cycle length than you will ever need (even considering birthday paradox) and the reduced state means it fits in a single cache line
    - masklinn 3y ago
      After the linked article as well as https://jandemooij.nl/blog/math-random-and-32-bit-precision/ https://jandemooij.nl/blog/math-random-and-32-bit-precision/ which follows from it, the main three browsers (Chrome[0], Firefox[1], Safari[2]) actually switched to Xorshift128+. So these days Math.random is nowhere near as horrifying as it was back then, however it's still not a system or a userland CSPRNG, for that you need `crypto.getRandomValues()` (https://developer.mozilla.org/en-US/docs/Web/API/Crypto/getRandomValues https://developer.mozilla.org/en-US/docs/Web/API/Crypto/getR...). [0] https://v8.dev/blog/math-random https://v8.dev/blog/math-random [1] https://bugzilla.mozilla.org/show_bug.cgi?id=322529#c99 https://bugzilla.mozilla.org/show_bug.cgi?id=322529#c99 [2] https://bugs.webkit.org/show_bug.cgi?id=151641 https://bugs.webkit.org/show_bug.cgi?id=151641

>as reliable a source of randomness as the system as the system could give you directly Not sure what you mean by this. Which system?

by yura 3y ago

>as reliable a source of randomness as the system as the system could give you directly Not sure what you mean by this. Which system?

gumby 3y ago

I thought that was the point GP’s comment is making, but a reply to a parallel comment to yours suggests otherwise.

fragmede 3y ago

The combination of the operating system (Linux/MacOS/Windows) and the particular hardware it has access to. With different hardware, /dev/(u)random has different qualities of entropy.

masklinn 3y ago
JS’s Math.random is not a system (or CS) RNG, and a few years back it was barely an RNG at all: https://medium.com/@betable/tifu-by-using-math-random-f1c308c4fd9d# https://medium.com/@betable/tifu-by-using-math-random-f1c308... So no, Math.random is very much not > as reliable a source of randomness as the system
- adgjlsfhk1 3y ago
  that's horrifying. I do slightly disagree with the final thoughts and works say that one of the xoshiro 256 generators is probably better than the 1024 ones. 256 bits of state is plenty to give you a longer cycle length than you will ever need (even considering birthday paradox) and the reduced state means it fits in a single cache line
  - masklinn 3y ago
    After the linked article as well as https://jandemooij.nl/blog/math-random-and-32-bit-precision/ https://jandemooij.nl/blog/math-random-and-32-bit-precision/ which follows from it, the main three browsers (Chrome[0], Firefox[1], Safari[2]) actually switched to Xorshift128+. So these days Math.random is nowhere near as horrifying as it was back then, however it's still not a system or a userland CSPRNG, for that you need `crypto.getRandomValues()` (https://developer.mozilla.org/en-US/docs/Web/API/Crypto/getRandomValues https://developer.mozilla.org/en-US/docs/Web/API/Crypto/getR...). [0] https://v8.dev/blog/math-random https://v8.dev/blog/math-random [1] https://bugzilla.mozilla.org/show_bug.cgi?id=322529#c99 https://bugzilla.mozilla.org/show_bug.cgi?id=322529#c99 [2] https://bugs.webkit.org/show_bug.cgi?id=151641 https://bugs.webkit.org/show_bug.cgi?id=151641