News for hackers. Stuff that matters.
Re:CoreCLR is now open source by simfoo on Tuesday February 03, 2015 @01:30PM (#8992183)
From their GetHashCode():

// We want to ensure we can change our hash function daily.

// This is perfectly fine as long as you don't persist the

// value from GetHashCode to disk or count on String A

// hashing before string B. Those are bugs in your code.

hash1 ^= ThisAssembly.DailyBuildNumber;

I'd love to hear the story behind this one :D

Re:CoreCLR is now open source by daeken on Tuesday February 03, 2015 @01:37PM (#8992241)
I don't know the story, but the logic behind it is simple: If you want to guarantee no one depends on GetHashCode staying static between runs of an application, change it all the time.
Re:CoreCLR is now open source by evincarofautumn on Tuesday February 03, 2015 @04:53PM (#8993673)
But now I can circumvent this hack by xoring with ThisAssembly.DailyBuildNumber again. :)
Re:CoreCLR is now open source by rplnt on Wednesday February 04, 2015 @10:26AM (#8997297)
I think the story is even simpler than that as the code in question is prefaced with: #if DEBUG

The shipped product doesn't include this "randomness".

Re:CoreCLR is now open source by MichaelGG on Tuesday February 03, 2015 @02:08PM (#8992484)
Also is it not for hash collision protection, which can end up hurting the runtime of many algorithms, causing a DoS?
Re:CoreCLR is now open source by plorkyeran on Tuesday February 03, 2015 @02:17PM (#8992567)
No, it has no effect on hash collisions. Two hashes that are equal before being xored with the daily build number will still be equal afterwards.
Re:CoreCLR is now open source by porges on Tuesday February 03, 2015 @02:27PM (#8992657)
It won't help much there as the number is static for a particular build.
Re:CoreCLR is now open source by munificent on Tuesday February 03, 2015 @03:37PM (#8993172)
The hash randomization for security is above this part of the code.
Re:CoreCLR is now open source by gus_massa on Tuesday February 03, 2015 @02:15PM (#8992550)
IIRC, a few yeas ago appeared a denial of service attack, probably originally for Phyton, but it was ported son to other languages.

The idea is that the hash is good enough for normal list, but it's not a cryptographic hash and it's easy to find collisions. Then you can make a lot of requests with strings that has the same hash value. Now the hash operations are O(N) instead of O(~1) and everything is slower.

Using an unpredictable hash calculation makes this attack more difficult.

Re:CoreCLR is now open source by omaranto on Tuesday February 03, 2015 @03:28PM (#8993112)
Your typo can be easily fixed by a Python one-liner:

    >>> (lambda w:w[2:]+w[:2])(''.join(sorted("Phyton",key=lambda c:math.sin(ord(c)^50))))
    'Python'
Re:CoreCLR is now open source by euroclydon on Tuesday February 03, 2015 @01:39PM (#8992253)
It's in a #if DEBUG statement so it would not change. Historically, even if they shipped the debug symbols, the assembly would have been built in release. Now, I suppose you could build it in debug.