4 ms·
Your understanding is correct but you're underselling very very in this context. It is astronomically unlikely to hit a collision with the advised generation m
by munk-a 2y ago
Your understanding is correct but you're underselling very very in this context. It is astronomically unlikely to hit a collision with the advised generation methods. If you want a possibly easier to grasp parallel git relies on SHA hashes never colliding and will break in a really awful way if you can produce two commits in a tree with the same hash - it's so astoundingly unlikely that people are okay summarizing it as "Never gonna happen" - it certainly will eventually, but it might not happen until the earth is swallowed by the sun.
- lulzury 2y agoWhat you stated makes intuitive sense, but it does make me wonder why the RFC states the following in the security considerations: > Implementations SHOULD NOT assume that UUIDs are hard to guess. For example, they MUST NOT be used as security capabilities (identifiers whose mere possession grants access). Discovery of predictability in a random number source will result in a vulnerability. https://datatracker.ietf.org/doc/html/rfc9562#name-security-considerations https://datatracker.ietf.org/doc/html/rfc9562#name-security-...
- jrochkind1 2y agoI don't know the math here specifically, but being hard to guess is a different quantity than chance of collision when following the algorithm. That is, if you aren't trying to have a collision and following the algorithm that has that aim, a collision can be exceedingly unlikely; but they can still be easy to guess if you are trying to predict someone else's assignment.
- stoperaticless 2y agoto illustrate point above: Sequence that easy to guess, but will never collide until it wraps back to 1. n1=1,n2=2,… (Caveat: if generated only by single node/thread)
- jrochkind1 2y agoThanks, not sure what's up with the downvotes, it's simply a fact of the math, and in particular the math here. A computer random number generator with a seed deterministically based on MAC address is another less trivial demonstration of the idea.
- necovek 2y agoThat's mostly focusing on broken RNG properties (i.e. static seed for a pseudo random generator, an outright bad algorithm, or bad entropy source for non-pseudo RNG). They make random numbers predictable, thus your UUIDs become predictable. Cryptographic hashes are usually also dependent on RNGs having good properties (encryption has been broken due to bad RNGs too), but they are a bit more involved to figure out even if you know the input randomness, and are easier to invalidate (change the secret).
- aero_code 2y ago"it certainly will eventually" - I think even that is underselling how unlikely it is for Git 256-bit hashes to collide. I calculated (taking into account the birthday paradox), that even if 8 billion people on Earth each created a Git commit every second, that they would have to do that non-stop for 1,588,059,911 trillion years before there's a 50% chance that any of the two commits have the same hash. Our sun is predicted to only last 0.005 trillion years more. √(2^256)×1.1774÷8000000000÷3600÷24÷365 = 1,588,059,910,945,875,138,261 UUIDs are more likely to collide but still basically impossible. You'd have to generate √(2^122)×1.1774 = 2714899559048203259 to have 50% chance of a collision. Just to store the UUIDs for that database would take 39,506,988 TB of space. If you aren't thinking about your database not fitting on millions of drives, don't think about UUID collisions.
- openthc 2y agoCollision Calculators: - https://alex7kom.github.io/nano-nanoid-cc/ https://alex7kom.github.io/nano-nanoid-cc/ - https://devina.io/collision-calculator https://devina.io/collision-calculator