Feed aggregator
Pre-Lunch Coffee Drinkers Enjoy Lower Risk of Death, Analysis Finds
Read more of this story at Slashdot.
Chinese RISC-V Project Teases 2025 Debut of Freely Licensed Advanced Chip Design
Read more of this story at Slashdot.
Scientists Find 'Spooky' Quantum Entanglement Within Individual Protons
Read more of this story at Slashdot.
CodeSOD: My Identification
Bejamin's team needed to generate a unique session ID value that can't easily be guessed. The traditional way of doing this would be to generate cryptographically secure random bytes. Most languages, including PHP, have a solution for doing that.
But you could also do this:
protected function _createId() { $id = 0; while (strlen($id) < 32) { $id .= mt_rand(0, mt_getrandmax()); } $id = md5(uniqid($id, true)); return $id; }Now, mt_rand is not cryptographically secure. They generate a random number (of arbitrary size) and concatenate it to a string. When the string is 32 characters long (including a leading zero), we call that enough.
This is not generating random bytes. To the contrary, the bytes it's generating are very not random, seeing as they're constrained to a character between 0 and 9.
We then pass that through the uniqid function. Now, uniqid also generates a non-cryptographically secure unique identifier. Here, we're specifying our large number is the prefix to that unique ID, and asking for more randomness to be added (the true parameter). This is better than what they did with the while loop above, though still not the "correct" way to do it.
Finally, we pass it through the md5 algorithm to reduce it to a hash, because we just love hash collisions.
It's impressive that, given a chance to make a choice about security-related features, they were able to make every single wrong choice.
This is also why you don't implement this stuff yourself. There are far more ways to get it wrong than there are ways to get it right.
[Advertisement] Keep all your packages and Docker containers in one place, scan for vulnerabilities, and control who can access different feeds. ProGet installs in minutes and has a powerful free version with a lot of great features that you can upgrade when ready.Learn more.Religious Leaders Experiment With AI In Sermons
Read more of this story at Slashdot.
Science Paper Piracy Site Sci-Hub Shares Lots of Retracted Papers
Read more of this story at Slashdot.
Man Used ChatGPT To Plan Las Vegas Cybertruck Blast
Read more of this story at Slashdot.
Lenovo Officially Announces the Legion Go S Handheld With SteamOS
Read more of this story at Slashdot.
Lenovo's Latest Laptop Has a Rollable OLED Screen
Read more of this story at Slashdot.
Review Roundup: OnePlus 13
Read more of this story at Slashdot.
Nvidia Launches RTX 50 Blackwell GPUs: From the $2,000 RTX 5090 To the $549 RTX
Read more of this story at Slashdot.
Big Landlord Settles With US, Will Cooperate In Price-Fixing Investigation
Read more of this story at Slashdot.
Thailand Bans Imports of Plastic Waste To Curb Toxic Pollution
Read more of this story at Slashdot.
Hackers Claim Massive Breach of Location Data Giant, Threaten To Leak Data
Read more of this story at Slashdot.
Crunchyroll Is Getting (Back) Into the Manga App Game
Read more of this story at Slashdot.
Chinese Venture Capitalists Force Failed Founders On To Debtor Blacklist
Read more of this story at Slashdot.
AI Startup Anthropic Raising Funding Valuing it at $60 Billion
Read more of this story at Slashdot.
Meta Ends Fact-Checking on Facebook, Instagram in Free-Speech Pitch
Read more of this story at Slashdot.
Popular DNA Sequencer Left Vulnerable By 7-Year-Old Firmware, Unfixed Security Flaws
Read more of this story at Slashdot.
Apple's AI Is Proving It's Anything But Intelligent
Read more of this story at Slashdot.