6 ms·
From their GetHashCode(): // We want to ensure we can change our hash function daily. // This is perfectly fine as long as you don't persist the // value fro
by simfoo 12y ago
From their GetHashCode():
// We want to ensure we can change our hash function daily.
// This is perfectly fine as long as you don't persist the
// value from GetHashCode to disk or count on String A
// hashing before string B. Those are bugs in your code.
hash1 ^= ThisAssembly.DailyBuildNumber;
I'd love to hear the story behind this one :D
- daeken 12y agoI don't know the story, but the logic behind it is simple: If you want to guarantee no one depends on GetHashCode staying static between runs of an application, change it all the time.
- MichaelGG 12y agoAlso is it not for hash collision protection, which can end up hurting the runtime of many algorithms, causing a DoS?
- plorkyeran 12y agoNo, it has no effect on hash collisions. Two hashes that are equal before being xored with the daily build number will still be equal afterwards.
- porges 12y agoIt won't help much there as the number is static for a particular build.
- munificent 12y agoThe hash randomization for security is above this part of the code.
- evincarofautumn 12y agoBut now I can circumvent this hack by xoring with ThisAssembly.DailyBuildNumber again. :)
- rplnt 12y agoI think the story is even simpler than that as the code in question is prefaced with: #if DEBUG The shipped product doesn't include this "randomness".
- euroclydon 12y agoIt's in a #if DEBUG statement so it would not change. Historically, even if they shipped the debug symbols, the assembly would have been built in release. Now, I suppose you could build it in debug.
- gus_massa 12y agoIIRC, a few yeas ago appeared a denial of service attack, probably originally for Phyton, but it was ported son to other languages. The idea is that the hash is good enough for normal list, but it's not a cryptographic hash and it's easy to find collisions. Then you can make a lot of requests with strings that has the same hash value. Now the hash operations are O(N) instead of O(~1) and everything is slower. Using an unpredictable hash calculation makes this attack more difficult.
- omaranto 12y agoYour typo can be easily fixed by a Python one-liner: >>> (lambda w:w[2:]+w[:2])(''.join(sorted("Phyton",key=lambda c:math.sin(ord(c)^50)))) 'Python'