dspeyer / ritualEngine

An engine for performing communal rituals online
GNU General Public License v2.0
4 stars 6 forks source link

secretId too small #199

Closed jeffkaufman closed 3 years ago

jeffkaufman commented 3 years ago
secretId = Math.round(Math.random()*1e9);
-- https://github.com/dspeyer/ritualEngine/blob/master/widgets/BucketSinging.js#L104

This hands enough of a risk of conflicts that I would feel safer if you increased it.

I'd recommend Math.round(Math.random()*Number.MAX_SAFE_INTEGER). This is under 2^64, which is what BB requires.

I would send a PR, but I'm not familiar enough with the ritual engine code to be sure this wouldn't break anything

dspeyer commented 3 years ago

Are you sure javascript won't "helpfully" treat that as a float and deliver it in scientific notation? It's your protocol, but ISTR trouble with that happening elsewhere.

On Fri, Dec 18, 2020 at 1:17 PM Jeff Kaufman notifications@github.com wrote:

secretId = Math.round(Math.random()*1e9); -- https://github.com/dspeyer/ritualEngine/blob/master/widgets/BucketSinging.js#L104

This hands enough of a risk of conflicts that I would feel safer if you increased it.

I'd recommend Math.round(Math.random()*Number.MAX_SAFE_INTEGER). This is under 2^64, which is what BB requires.

I would send a PR, but I'm not familiar enough with the ritual engine code to be sure this wouldn't break anything

— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub https://github.com/dspeyer/ritualEngine/issues/199, or unsubscribe https://github.com/notifications/unsubscribe-auth/AA5ON5TUJX2KAVD4LK4TVBTSVOMCHANCNFSM4VBQPIWQ .

dspeyer commented 3 years ago

It's fundamentally BBS so I'll trust Jeff. Done.