Popular posts

@fczbkk That's exactly what is being used in the above example.

@saiki Ah, ok. Now I see, this is a plain GUID variant. I'm so used to UUID4, that I was looking for version number and reserved bit.

Math.random is not cryptographically random which means your generated GUIDs will eventually hit duplicates. I quote from Mozilla:

Note: Math.random() does not provide cryptographically secure random numbers. Do not use them for anything related to security. Use the Web Crypto API instead, and more precisely the window.crypto.getRandomValues() method.

Interesting, @JanVladimirMostert. The RFC spec for UUIDs allows for pseudo-random numbers; and Math.random() is a pseudo random number generator.

I think cryptographically secure randomness has nothing to do with the generated GUIDs eventually hitting duplicates. Cryptographic randomness is just randomness that is hard to predict while staying computationally indistinct from uniform randomness; and it would only matter if you are creating something that you want to keep private, say like, cryptographic keys.

It obviously depends what you use it for, if you're expecting that GUID to be unique and unpredictable, then the way you're generating it is wrong, if it's just a pseudo random GUID for use to trace messages for example, it should be fine, but in order to be a valid GUID, it needs to comply with either UUID1/2/3/4/5 specifications as well, see here: en.wikipedia.org/wiki/Universally_unique_identifi…

If these GUIDs needs to be unique and unpredictable, then a using a non-cryptographically random algorithm will cause duplicates fairly quickly, I've seen this many times in production on systems where people were doing exactly this. Where a cryptographically-random generated GUID is used, it will be very hard to hit duplicates, on several of these systems where clients were hitting duplicates from time to time, the cryptographically random GUID has yet to hit a duplicate.

@JanVladimirMostert Ah, I see! Noted. :)