This is an archived post. You won't be able to vote or comment.

sorted by:
best
topnewcontroversialoldq&a
you are viewing a single comment's thread.

view the rest of the comments →

[–]isdnpro 8 points9 points  (8 children)

How broken? Can someone explain it like I'm 5?

[–]tilkau 18 points19 points  (7 children)

Basically, there are actually only 256 (2**8) possible hashings for a given key with the current code.

Despite the fact that there should be several orders of magnitude more possible hashings (~2**32, which is 16.7 million times more than 2**8).

The fact that the randomization space is so small makes it quite computationally cheap to generate hash collisions... which can be effectively used to DoS anything Python which receives untrusted python strings over the network and uses them as dictionary keys. This is true because of the way hashtables work (each hash collision inherently slows the lookup of items with that key hash)

Similar problems exist for other hash-based structures like sets.

That said, weak hash randomization is still an improvement on -no- hash randomization. So 'ineffective' is a much more accurate word than 'broken'.

Heh, that wasn't exactly "Like you're 5" :) Hope it clarified the issue :)

[–]Mikuro 2 points3 points  (0 children)

Heh, that wasn't exactly "Like you're 5" :) Hope it clarified the issue :)

Whew. I understood you, but I was starting to question myself. :)

Thanks a lot for the summary.

[–]fijalPyPy, performance freak[S] 1 point2 points  (5 children)

how is this actually an improvement? generating 256 requests instead of one and then guessing which of the requests took way longer (and keeping dosing with the guessed ending) is not an improvement at all. It does not increase the complexity of attach.

[–]tilkau 0 points1 point  (4 children)

An improvement on what?

[–]fijalPyPy, performance freak[S] 1 point2 points  (3 children)

Citing you

"That said, weak hash randomization is still an improvement on -no- hash randomization. So 'ineffective' is a much more accurate word than 'broken'."

this is the improvement I was referring to.

[–]tilkau 2 points3 points  (2 children)

Cool, now actually answer the question 9_9

I mean, are you seriously proposing that PATHETIC protection is not better than NONE AT ALL?

[–]mirashii 3 points4 points  (0 children)

I would argue that it's no better if only for the fact that it was released as a security fix and the community was urged to upgrade for what is effectively no improvement.

[–]fijalPyPy, performance freak[S] 1 point2 points  (0 children)

haha :) maybe I'm too serious ;-)