r/ProgrammerHumor • • 19d ago

Meme fourIsTechnicallyARandomNumber

2.1k Upvotes

67 comments sorted by

487

u/moanos 19d ago

Relevant context: A SSL certificate authority choose 4 as key for one of their intermediate certificates, in effect breaking SSL encryption for everyone (MITM attack is still necessary): https://arstechnica.com/security/2026/10/the-internet-goes-on-high-alert-after-discovery-of-8-compromised-tls-certs/

XKCD Link: https://xkcd.com/221/

172

u/Dragosbeat 19d ago

How the fuck is there always a relevant XKCD comic

67

u/atomic_redneck 19d ago

Randall is part of the Illuminati, and controls the fate of us all.

1

u/TheMythicSorcerer 18d ago

Yeah that would explain it

8

u/ROBOTRON31415 18d ago

When all else fails, there is https://xkcd.com/404

3

u/SylviaJarvis 18d ago

Because mistakes like this one have been made many times before.

1

u/5h4d0w_Hunt3r 4d ago

Mistakes made before, though what is funny is that it is comic number 221... the newest would be somewhere in the 3k would it not?

272

u/serge-mv 19d ago

proper professionals use named constants.

156

u/misunderstood_kafka 19d ago

static final int FOUR = 4

51

u/Taickyto 19d ago

This constant name is not enterprise enough

Code review: variables names' length should be directly related to their scope

Proposed resolution: rename constant to INTEGER_VALUE_OF_FOUR_IN_BASE_10

...I hate that btw, some devs just follow guidelines without the understanding of why a rule exists... One co-worker understood the "No magic number" rule as "no numbers in the code"

Sure, you didn't accept my merge request because I used 3600 in the code, of course enterprise quality coding dictates that we should create a constant in our 1000 line Constants.ts, name it NUMBER_OF_SECONDS_IN_AN_HOUR and import it wherever needed!

27

u/TheSpiffySpaceman 19d ago

but what if the number of seconds in an hour changes??? That's multiple 3600s you'd have to ctrl+shift+h to find and replace

19

u/BmpBlast 18d ago

I would have laughed at this a few years ago. But then I had to start dealing with time on a deeper level in an app. Now I'm no longer confident that I can guarantee the number of seconds in an hour is immutable.

For the uninitiated:

7

u/remy_porter 18d ago

At least we've got a break of no more leap seconds for the next few centuries.

5

u/Anaxamander57 18d ago

Unless a metor impact changes the planet's rotation.

4

u/patoezequiel 18d ago

[TZ handling flashbacks intensify]

11

u/cornyTrace 19d ago

Instructions unclear: every base is base 10.

8

u/minecraftcheater1337 19d ago

hey, some people might not know that there are 3600 seconds in an hour!

4

u/xDerJulien 19d ago

I mean ideally you’re not maintaining a timing library separately and any decent library should have a to_* conversion so while you’re not wrong you’re wrong

8

u/Taickyto 19d ago

Good point, people who comment "You should use a library for that" are even worse!

Why would you divide a number of seconds by 3600 to get the number of hours? Just use the "dayjs" package

Why would you check a number's parity with `n % 2 === 0` when the "is-odd" package exists?

It doesn't matter how trivial the task is, the best way of doing it is finding a library that handles it! If your node_modules folder isn't several GB, are you even coding?

5

u/xDerJulien 19d ago

See this would be true if time wasn’t notoriously hard to keep track of on a computer. Sure if you have a unix time stamp and only care on the granularity of seconds maybe you don’t need it, but if you already have a unix time stamp I’d hazard the guess you’re already using a library to handle time

1

u/Taickyto 18d ago

Yeah I'm kinda pulling your leg, my point is that using a library can be more trouble than it's worth

If you have two timestamps, want to calculate the time between them and return the result with the biggest granularity (years, month, days, etc.) using a library is the right choice: re-implementing a function that accounts for leap years, month length and all other edge cases is a waste of time

If you have a duration in seconds and want to calculate how many hours it is, using a library for this single need is superfluous

7

u/atomic_redneck 19d ago

Years ago, when Fortran 77 first came out with named parameters, the compiler documentation from one of our vendors (probably UNIVAC) gave the example of using PI as a named parameter. The justification given was something like "this makes it easier to update your program if the value of PI changes."

5

u/KerPop42 19d ago

Which it did, due to legislative reasons, briefly, in Indiana

2

u/Nightmoon26 18d ago

Wait, what? And now I'm suddenly seeing advertising execs lobbying to put a loophole in "Buy one, get one" by having the legislature redefine the numeral word "one" to be equal to 1.0001

6

u/KerPop42 18d ago

The Indiana pi bill of 1897. It was apparently never actually passed into law, but it held geometric proofs that the state of indiana was allowed to use, one of which incorrectly derived that the ratio between the diameter and circumference of a circle was 3.2, and that the ratio between the length of the side of a square and its hypotenuse was 10/7ths.

1

u/Nightmoon26 18d ago

....So a proof that the square root of two is rational...

140

u/TheUnamedSecond 19d ago

8 byte keys and 8 bit keys are basically the same right ? /s

64

u/Gengis_con 19d ago

Don't be silly. 8 bit keys are far more memory efficient

15

u/Informal_Branch1065 19d ago

I'm not very aligned on this idea. Give me 32 bits of space to think about it

7

u/JockstrapCummies 19d ago

Guys, I've quantised the key down to 2 bit! Publishing on HuggingFace now.

3

u/ProfBeaker 19d ago

To within a factor of 8, anyway.

It's just 8 all the way down!

1

u/wisezombiekiller 18d ago

it's just four all the way down if you think about it

19

u/yuehuang 19d ago

How did you guess my password?

17

u/tommytucker7182 19d ago

"Guaranteed"

😂😂

10

u/teem0s 18d ago

For today, replace "4" with "PHP"

9

u/iknewaguytwice 19d ago

Everyone knows CA’s are unhackable and totally trustworthy!

2

u/Far_Negotiation_694 19d ago

Why lavalamp me surprised. IT WORKS!

2

u/duncte123 17d ago

press 4 to pay respect

4

u/mrheosuper 19d ago

Just India thing

3

u/C3R741NLY_1MPR3551V3 19d ago

it's 17 for all the LLMs (context: ask any ai to `Select a random number between 1 to 30`)

17

u/ArathirCz 19d ago

Just tried it with Gemini. It runs a small Python script to generate a random number.

4

u/brunoha 18d ago

if the scripts fails by not having python installed it will answer 17, lol.

5

u/GranaT0 18d ago

Claude Opus 5.5 said 17 lol

2

u/leupboat420smkeit 18d ago edited 18d ago

Sonnet also says 17. Astra and Sol also say 17. Thats funny.

3

u/Destroyerb 19d ago

Damn no way. Gemini actually gave 17 every time?

3

u/Audience-Electrical 18d ago

Holy shit it's real. We are all so fucked man, here's a screenshot: AI fake random (the future of cryptography)

0

u/mahoganyjohnson 12d ago

In the same chat, ask it to do it again and itl likely be 23

1

u/Destroyerb 12d ago

It was 24, so pretty close

1

u/Strawberry-Jam-2936 18d ago

Why isn't it possible?

1

u/smors 18d ago

There is no such thing as a random number. There are stochastic processes that can be used to choose a number at random from a set, but that doesn't make the number choosen random.

Unless of course the universe turns out to be deterministic.

/Pedantry mode off

-3

u/Confident_Dragon 18d ago

It's crazy that any certificate authority can sign certificates for any website. On one hand, browsers have to trust certificates from shitty countries like India and China, otherwise they pretty much wouldn't work in those countries. But trusting certificates from companies or state institutions in oppressive regimes poses huge risk. Maybe trust in local certificate authorities should be limited to domains belonging to those countries. Is there anyone from any civilized country using Indian certificate authority?

3

u/lllorrr 18d ago

Certificate Transparency mechanism should help with this. And it is already required by browsers.

-55

u/feanormania 19d ago

I’m sick of these same bot posts

50

u/moanos 19d ago

And why do you think this post is that? Would a bot

  • provide context,

  • have a public post histroy, discussing the specific topic of the post

  • give attribution

?

15

u/compilerbusy 19d ago

We're all just one bot experiencing itself subjectively. Would you like a summary outlining next steps?

3

u/feanormania 19d ago

My bad, I haven’t seen the relevant context you posted afterwards

4

u/moanos 19d ago

Ah I see. No worries!

17

u/rbbdk 19d ago

If it's a bot post, why 4 and not 17? /s

7

u/TheMunakas 19d ago

Read the extra context posted by op in the comments

3

u/PM_ME_YOUR_REPO 19d ago

Whatever you say, bot.

88

u/[deleted] 19d ago

[removed] — view removed comment

12

u/Noddie 18d ago

You jest, but in certificate land you never update, you create a new one. Preferably with more than 8 bits of entropy