News for hackers. Stuff that matters.

A comment on Supercolliding a PHP array (inserting 65536 elements takes 30 seconds). Parent comment

Re:Supercolliding a PHP array (inserting 65536 elements take... by mdwrigh2 on Thursday December 29, 2011 @12:07PM (#3404288)
Well, this isn't exploitable if you use a randomized hash function like Ruby 1.9 does.

See http://www.ocert.org/advisories/ocert-2011-003.html for a listing of vulnerable languages (and yes, Python is on the list).

[ Parent | on HN ]
Re:Supercolliding a PHP array (inserting 65536 elements take... by chc on Thursday December 29, 2011 @12:32PM (#3404383)
You make it sound like you're somehow disagreeing with him, but what he says is true even of Ruby's hash algorithm. Introducing randomness into the hash function is really just a band-aid on this vulnerability. The inherent vulnerability is there either way; you just need a bit of runtime information to do the attack when runtime information is introduced into the hash function.
[ Parent | on HN ]