Hacker News Reader

Comment by pcj-github | Hacker News Reader

If it can't be made stable, `git archive` should specifically add random content (under a feature flag to be removed after a year or two) to so as to make the generated checksum completely unreliable and force users to adopt different workflows.

View on HN

Golang does this with hashmaps, it deliberately randomizes the keys’ order so that you can never depend on it. People hated it for a few months, but now it’s just another known idiom.

Hyrum’s Law applies, even when you take into account Hyrum’s Law. :)

A story about a Golang program that had assumed map iteration was uniformly random but it’s not, which caused a load balancer to assign work unevenly:

https://dev.to/wallyqs/gos-map-iteration-order-is-not-that-r...

A graph of the map iteration order’s distribution showing that it’s not uniformly random:

https://twitter.com/cafxx/status/1135190309514620928

Ok, you win, have a favorite.

From the language specification: "The iteration order over maps is not specified and is not guaranteed to be the same from one iteration to the next."

There's a long shot between "not specified" and "uniformly random".

The joke is that the sort of people who rely on apparent behaviour in practice isn’t the sort that tends to look things up in specifications.

Perl did that too IIRC, although motivation was to avoid predictable hash collisions that might put program into slow path

Didn't Python introduce that, too, after a high profile DoS CVE around 10 years ago?

Yes.

https://docs.python.org/3/reference/datamodel.html#object.__...

> Changed in version 3.3: Hash randomization is enabled by default.

But since Python 3.6 dicts keep the insertion order, so the order of iteration is deterministic again.

That’s mainly for security reasons, mainly preventing Hash DDoS attacks, therefore a requirement.

Randomly ordering the files, without adding random content, would do the trick.

Interesting idea, to make "undefined behavior" explicit.

Reply on news.ycombinator.com