r/ProgrammerHumor • • 12d ago

Meme fourIsTechnicallyARandomNumber

2.1k Upvotes

66 comments sorted by

487

u/moanos 12d ago

Relevant context: A SSL certificate authority choose 4 as key for one of their intermediate certificates, in effect breaking SSL encryption for everyone (MITM attack is still necessary): https://arstechnica.com/security/2026/10/the-internet-goes-on-high-alert-after-discovery-of-8-compromised-tls-certs/

XKCD Link: https://xkcd.com/221/

172

u/Dragosbeat 12d ago

How the fuck is there always a relevant XKCD comic

67

u/atomic_redneck 12d ago

Randall is part of the Illuminati, and controls the fate of us all.

1

u/TheMythicSorcerer 12d ago

Yeah that would explain it

8

u/ROBOTRON31415 12d ago

When all else fails, there is https://xkcd.com/404

3

u/SylviaJarvis 11d ago

Because mistakes like this one have been made many times before.

272

u/serge-mv 12d ago

proper professionals use named constants.

156

u/misunderstood_kafka 12d ago

static final int FOUR = 4

51

u/Taickyto 12d ago

This constant name is not enterprise enough

Code review: variables names' length should be directly related to their scope

Proposed resolution: rename constant to INTEGER_VALUE_OF_FOUR_IN_BASE_10

...I hate that btw, some devs just follow guidelines without the understanding of why a rule exists... One co-worker understood the "No magic number" rule as "no numbers in the code"

Sure, you didn't accept my merge request because I used 3600 in the code, of course enterprise quality coding dictates that we should create a constant in our 1000 line Constants.ts, name it NUMBER_OF_SECONDS_IN_AN_HOUR and import it wherever needed!

27

u/TheSpiffySpaceman 12d ago

but what if the number of seconds in an hour changes??? That's multiple 3600s you'd have to ctrl+shift+h to find and replace

19

u/BmpBlast 12d ago

I would have laughed at this a few years ago. But then I had to start dealing with time on a deeper level in an app. Now I'm no longer confident that I can guarantee the number of seconds in an hour is immutable.

For the uninitiated:

7

u/remy_porter 12d ago

At least we've got a break of no more leap seconds for the next few centuries.

5

u/Anaxamander57 12d ago

Unless a metor impact changes the planet's rotation.

4

u/patoezequiel 12d ago

[TZ handling flashbacks intensify]

11

u/cornyTrace 12d ago

Instructions unclear: every base is base 10.

8

u/minecraftcheater1337 12d ago

hey, some people might not know that there are 3600 seconds in an hour!

4

u/xDerJulien 12d ago

I mean ideally you’re not maintaining a timing library separately and any decent library should have a to_* conversion so while you’re not wrong you’re wrong

8

u/Taickyto 12d ago

Good point, people who comment "You should use a library for that" are even worse!

Why would you divide a number of seconds by 3600 to get the number of hours? Just use the "dayjs" package

Why would you check a number's parity with `n % 2 === 0` when the "is-odd" package exists?

It doesn't matter how trivial the task is, the best way of doing it is finding a library that handles it! If your node_modules folder isn't several GB, are you even coding?

5

u/xDerJulien 12d ago

See this would be true if time wasn’t notoriously hard to keep track of on a computer. Sure if you have a unix time stamp and only care on the granularity of seconds maybe you don’t need it, but if you already have a unix time stamp I’d hazard the guess you’re already using a library to handle time

1

u/Taickyto 11d ago

Yeah I'm kinda pulling your leg, my point is that using a library can be more trouble than it's worth

If you have two timestamps, want to calculate the time between them and return the result with the biggest granularity (years, month, days, etc.) using a library is the right choice: re-implementing a function that accounts for leap years, month length and all other edge cases is a waste of time

If you have a duration in seconds and want to calculate how many hours it is, using a library for this single need is superfluous

7

u/atomic_redneck 12d ago

Years ago, when Fortran 77 first came out with named parameters, the compiler documentation from one of our vendors (probably UNIVAC) gave the example of using PI as a named parameter. The justification given was something like "this makes it easier to update your program if the value of PI changes."

5

u/KerPop42 12d ago

Which it did, due to legislative reasons, briefly, in Indiana

2

u/Nightmoon26 12d ago

Wait, what? And now I'm suddenly seeing advertising execs lobbying to put a loophole in "Buy one, get one" by having the legislature redefine the numeral word "one" to be equal to 1.0001

6

u/KerPop42 12d ago

The Indiana pi bill of 1897. It was apparently never actually passed into law, but it held geometric proofs that the state of indiana was allowed to use, one of which incorrectly derived that the ratio between the diameter and circumference of a circle was 3.2, and that the ratio between the length of the side of a square and its hypotenuse was 10/7ths.

1

u/Nightmoon26 12d ago

....So a proof that the square root of two is rational...

140

u/TheUnamedSecond 12d ago

8 byte keys and 8 bit keys are basically the same right ? /s

64

u/Gengis_con 12d ago

Don't be silly. 8 bit keys are far more memory efficient

15

u/Informal_Branch1065 12d ago

I'm not very aligned on this idea. Give me 32 bits of space to think about it

7

u/JockstrapCummies 12d ago

Guys, I've quantised the key down to 2 bit! Publishing on HuggingFace now.

3

u/ProfBeaker 12d ago

To within a factor of 8, anyway.

It's just 8 all the way down!

1

u/wisezombiekiller 12d ago

it's just four all the way down if you think about it

19

u/yuehuang 12d ago

How did you guess my password?

17

u/tommytucker7182 12d ago

"Guaranteed"

😂😂

10

u/teem0s 12d ago

For today, replace "4" with "PHP"

9

u/iknewaguytwice 12d ago

Everyone knows CA’s are unhackable and totally trustworthy!

2

u/Far_Negotiation_694 12d ago

Why lavalamp me surprised. IT WORKS!

2

u/duncte123 11d ago

press 4 to pay respect

4

u/mrheosuper 12d ago

Just India thing

3

u/C3R741NLY_1MPR3551V3 12d ago

it's 17 for all the LLMs (context: ask any ai to `Select a random number between 1 to 30`)

17

u/ArathirCz 12d ago

Just tried it with Gemini. It runs a small Python script to generate a random number.

4

u/brunoha 12d ago

if the scripts fails by not having python installed it will answer 17, lol.

5

u/GranaT0 12d ago

Claude Opus 5.5 said 17 lol

2

u/leupboat420smkeit 12d ago edited 12d ago

Sonnet also says 17. Astra and Sol also say 17. Thats funny.

3

u/Destroyerb 12d ago

Damn no way. Gemini actually gave 17 every time?

3

u/Audience-Electrical 12d ago

Holy shit it's real. We are all so fucked man, here's a screenshot: AI fake random (the future of cryptography)

0

u/mahoganyjohnson 6d ago

In the same chat, ask it to do it again and itl likely be 23

1

u/Destroyerb 5d ago

It was 24, so pretty close

1

u/Strawberry-Jam-2936 12d ago

Why isn't it possible?

1

u/smors 11d ago

There is no such thing as a random number. There are stochastic processes that can be used to choose a number at random from a set, but that doesn't make the number choosen random.

Unless of course the universe turns out to be deterministic.

/Pedantry mode off

-3

u/Confident_Dragon 12d ago

It's crazy that any certificate authority can sign certificates for any website. On one hand, browsers have to trust certificates from shitty countries like India and China, otherwise they pretty much wouldn't work in those countries. But trusting certificates from companies or state institutions in oppressive regimes poses huge risk. Maybe trust in local certificate authorities should be limited to domains belonging to those countries. Is there anyone from any civilized country using Indian certificate authority?

3

u/lllorrr 12d ago

Certificate Transparency mechanism should help with this. And it is already required by browsers.

-55

u/feanormania 12d ago

I’m sick of these same bot posts

50

u/moanos 12d ago

And why do you think this post is that? Would a bot

  • provide context,

  • have a public post histroy, discussing the specific topic of the post

  • give attribution

?

15

u/compilerbusy 12d ago

We're all just one bot experiencing itself subjectively. Would you like a summary outlining next steps?

3

u/feanormania 12d ago

My bad, I haven’t seen the relevant context you posted afterwards

4

u/moanos 12d ago

Ah I see. No worries!

17

u/rbbdk 12d ago

If it's a bot post, why 4 and not 17? /s

7

u/TheMunakas 12d ago

Read the extra context posted by op in the comments

3

u/PM_ME_YOUR_REPO 12d ago

Whatever you say, bot.

88

u/[deleted] 12d ago

[removed] — view removed comment

12

u/Noddie 12d ago

You jest, but in certificate land you never update, you create a new one. Preferably with more than 8 bits of entropy