9 hours ago
- V8's Math.random() PRNG is weak for generating unique IDs, as discovered by Mike Malone.
- Unique IDs require either stateful mechanisms (like counters with persistence) or a large random space with uniform distribution to make collisions negligible.
- Using a large enough random space (e.g., 160 bits) makes collision probability astronomically low, even at high generation rates.
- A stateless approach using cryptographic hash functions (like SHA1) with a seed from /dev/urandom and a progressive counter is fast, reliable, and requires no PRNG analysis.
- Seeding with OS entropy prevents replay of the same sequence after restarts.
- Using HMAC with the seed as secret and counter as message adds unpredictability to the generated IDs.
- This method is used in the Disque project for distributed message ID generation.