Beefy Boxes and Bandwidth Generously Provided by pair Networks
Perl-Sensitive Sunglasses
 
PerlMonks  

Re^9: Hash order randomization is coming, are you ready?

by demerphq (Chancellor)
on Dec 03, 2012 at 22:48 UTC ( #1006957=note: print w/replies, xml ) Need Help??


in reply to Re^8: Hash order randomization is coming, are you ready?
in thread Hash order randomization is coming, are you ready?

that I have assumed the "new" constraints as a matter of course ever since the randomisation fix for Algorithmic Complexity Attack that was (breifly???) implement in 5.8.1.

Alas not everyone has been as diligent as you. :-) It is surprising how many real bugs this found.

what has actually changed internally

Ok, first some history. In 5.8.1 a very similar patch the one I have been working on was implemented. It broke lots of stuff, which was considered unacceptable for a minor release. So a new implementation was done. This implementation actually supported two types of hash, and two seeds, one constant determined at build time, and one random per process. By default hashes would use the constant seed, but when Perl noticed too many collisions in a bucket it would trigger a "rehash" using a random per-process seed, which would cause the hash value of all of its keys to be reclaculatied and would as a byproduct cause the hash'es keys to be removed from the shared string table.

All of this consumed processing time, and added code complexity.

5.17.6 returned things to roughly where they were in 5.8.1. The rehash mechanism and all overheads associated with it are removed. The hash seed is randomly initialized per process. etc.

Somewhat related is the actual hash function in 5.17.6 is different from 5.17.5, and we probably will use a yet again different hash function in 5.18.

And if I have my way hashes will be randomized on a per hash level as well. (So every hash would have its own order, regardless of what keys it stores or the history of the hash.

---
$world=~s/war/peace/g

  • Comment on Re^9: Hash order randomization is coming, are you ready?

Replies are listed 'Best First'.
Re^10: Hash order randomization is coming, are you ready?
by BrowserUk (Pope) on Dec 04, 2012 at 01:13 UTC
    5.17.6 returned things to roughly where they were in 5.8.1.

    Okay. Thanks for that. I was party to some of thr discussion for the 5.8.1 randomisation, so that makes sense to me.

    Somewhat related is the actual hash function in 5.17.6 is different from 5.17.5, and we probably will use a yet again different hash function in 5.18.

    Can you explain why the hash function has changed? And what is has changed (is going to change) to?

    A reference to background material regarding the selection and testing of the new hash functions whould be interesting and useful.

    And if I have my way hashes will be randomized on a per hash level as well.

    Could you briefly explain why you would do that? What it would achieve or prevent?


    With the rise and rise of 'Social' network sites: 'Computers are making people easier to use everyday'
    Examine what is said, not who speaks -- Silence betokens consent -- Love the truth but pardon error.
    "Science is about questioning the status quo. Questioning authority".
    In the absence of evidence, opinion is indistinguishable from prejudice.

    RIP Neil Armstrong

      Prevention of algorithmic complexity attacks.

      ---
      $world=~s/war/peace/g

        Prevention of algorithmic complexity attacks.

        Hm. That is reasoning for randomising the seed for the hashing algorithm; but not reasoning for changing the hash algorithm itself.

        It also doesn't explain why you would do it on a hash-by-hash basis rather than a per-process basis.

        I don't get the reluctance to share this information?


        With the rise and rise of 'Social' network sites: 'Computers are making people easier to use everyday'
        Examine what is said, not who speaks -- Silence betokens consent -- Love the truth but pardon error.
        "Science is about questioning the status quo. Questioning authority".
        In the absence of evidence, opinion is indistinguishable from prejudice.

        RIP Neil Armstrong

Log In?
Username:
Password:

What's my password?
Create A New User
Node Status?
node history
Node Type: note [id://1006957]
help
Chatterbox?
[Corion]: Maybe the solution would be a tablet (with pens), like the Wacom tablets, but you still need good software and need to know how to operate it well in an interactive setting ;)
[ambrus]: Corion: the solution depends on who for. Some non-math presentations need to show lots of graphics or photos, with fine details and color. For those, blackboard or overhead transparencies aren't so good (yes, you can print on transparencies, but there's s
[ambrus]: ome quality limits), but film projection or computer projector is fine.
[ambrus]: A minority of math presenters are traditional and don't want to operate a computer. For them, handwritten overhead transparencies and blackboard are fine.
[Corion]: BTW, has anybody seen the Microsoft Surface Studio thing live?
[ambrus]: Some will operate a computer, but want to operate crazy unusable android-like GUIs. For those, printed overhead transparencies or simple slide editors and maybe even tablets are fine.

How do I use this? | Other CB clients
Other Users?
Others making s'mores by the fire in the courtyard of the Monastery: (9)
As of 2017-09-26 10:34 GMT
Sections?
Information?
Find Nodes?
Leftovers?
    Voting Booth?
    During the recent solar eclipse, I:









    Results (293 votes). Check out past polls.

    Notices?