Technology1 min read

CodeSOD: Plenty of IDs

By · Published by Everything Blog

In short

The launcher script was intended to create unique five-digit identifiers for every provisioned virtual machine, but its non-replacement sampling limits outputs to numbers with non-repeating digits. This logic reduces the total pool of available identifiers from 100,000 down to just 30,240. The script constructs these restricted identifiers by mapping the sampled numbers to text and joining them into strings. Due to the birthday problem, this shrunken pool causes the probability of duplicate identifiers to hit 50% after only 206 requests.

Key points

  • Using non-replacement digit selection severely restricts the available unique identifiers…: Using non-replacement digit selection severely restricts the available unique identifiers for provisioned virtual machines.
  • The reduced identifier pool sharply accelerates collision likelihood due to the mathemati…: The reduced identifier pool sharply accelerates collision likelihood due to the mathematical effects of the birthday problem.
  • A 50% chance of an identifier collision occurs rapidly once the system reaches only 206 r…: A 50% chance of an identifier collision occurs rapidly once the system reaches only 206 requests.

Sources checked by our analysis pipeline: 1

Venkat joined a new team in the middle of a big refactoring effort. The code was quite a mess, glued together by long Python scripts with main functions longer than a Tolstoy novel. It was this effort to clean up the code into neat modules that highlighted some logical issues with their implementation.

def generate_random_number():

""" Generate a 5 digit random number.

"""

return "".join(map(str, random.sample(range(0,10),5)))

The script this function comes from is a launcher script that provisions a VM to execute code. The VM needs a unique identifier, and we get that random number this way.

The random.sample

function, in Python, samples a population without replacement. So here, we pass it a range of 0-10 (which is 0-9 inclusive), and ask for five random entries from it. Again, without replacement, so a range that could concievably contain up to 100,000 possible values is significantly constrained down to 30,000 or so- only the numbers less than 100,000 that contain no duplicate digits.

We then map

the resulting array into an array of strings, then join that into a final output…

Technology