{"action":"created","issue":{"url":"https://api.github.com/repos/bugsnag/bugsnag-js/issues/332","repository_url":"https://api.github.com/repos/bugsnag/bugsnag-js","labels_url":"https://api.github.com/repos/bugsnag/bugsnag-js/issues/332/labels{/name}","comments_url":"https://api.github.com/repos/bugsnag/bugsnag-js/issues/332/comments","events_url":"https://api.github.com/repos/bugsnag/bugsnag-js/issues/332/events","html_url":"https://github.com/bugsnag/bugsnag-js/pull/332","id":304449938,"number":332,"title":"Switch (u)uid implementation","user":{"login":"bengourley","id":609579,"avatar_url":"https://avatars1.githubusercontent.com/u/609579?v=4","gravatar_id":"","url":"https://api.github.com/users/bengourley","html_url":"https://github.com/bengourley","followers_url":"https://api.github.com/users/bengourley/followers","following_url":"https://api.github.com/users/bengourley/following{/other_user}","gists_url":"https://api.github.com/users/bengourley/gists{/gist_id}","starred_url":"https://api.github.com/users/bengourley/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bengourley/subscriptions","organizations_url":"https://api.github.com/users/bengourley/orgs","repos_url":"https://api.github.com/users/bengourley/repos","events_url":"https://api.github.com/users/bengourley/events{/privacy}","received_events_url":"https://api.github.com/users/bengourley/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-03-12T16:40:59Z","updated_at":"2018-03-12T21:52:08Z","closed_at":null,"author_association":"MEMBER","pull_request":{"url":"https://api.github.com/repos/bugsnag/bugsnag-js/pulls/332","html_url":"https://github.com/bugsnag/bugsnag-js/pull/332","diff_url":"https://github.com/bugsnag/bugsnag-js/pull/332.diff","patch_url":"https://github.com/bugsnag/bugsnag-js/pull/332.patch"},"body":"`cuid()` was great but it caused problems when bundling with rollup (#331). Newer versions of cuid that have been published fix the rollup issues but it [no longer supports IE8](https://github.com/ericelliott/cuid/pull/99) (which we need). The maintainers didn't want to merge our PR.\r\n\r\nOur options were to\r\n\r\n1. maintain a fork of cuid with the minor change needed to support IE8\r\n2. find a different uid implementation\r\n\r\nEvery alternative implementation I tried added bytes to our minified bundle, but I was focused on reducing bundle size if possible. One of the benefits of (1.) would have been that we could remove the `.slug()` feature of that library, which we didn't use. However, the smallest option I tried was this [uuid v4](https://gist.github.com/LeverOne/1308368) implementation. It wasn't on npm so I added it directly to our codebase.\r\n\r\nThis shaves .23kB from the bundle size, and brings us back down to the \"budget\" of 10kB ⚖️.\r\n\r\nNow raise my concerns…\r\n- we currently use the id generator for unique session ids\r\n- the pipeline does not currently even use the ids themselves\r\n- how likely is a collision with this new implementation?\r\n- what are the ramifications of having a collision now, and in the future?\r\n\r\nIn the tests that I added, I run 100k iterations to check for collisions. I found this to be the largest number that meant the unit tests terminate within a few seconds. I bumped the value up to 1M and ran the tests multiple times without collision on my machine. However, the vector most likeley to cause collisions probably isn't running the same algorithm sequentially on one machine, it's probably some freak occurrence of two machines on opposite sides of the world having the same series of `Math.random()` results.\r\n\r\nOn balance, I think the perf gain from a smaller bundle outweighs these issues. But my take is that we should bear them in mind – especially when the pipeline starts using the session ids."},"comment":{"url":"https://api.github.com/repos/bugsnag/bugsnag-js/issues/comments/372475155","html_url":"https://github.com/bugsnag/bugsnag-js/pull/332#issuecomment-372475155","issue_url":"https://api.github.com/repos/bugsnag/bugsnag-js/issues/332","id":372475155,"user":{"login":"ericelliott","id":364727,"avatar_url":"https://avatars1.githubusercontent.com/u/364727?v=4","gravatar_id":"","url":"https://api.github.com/users/ericelliott","html_url":"https://github.com/ericelliott","followers_url":"https://api.github.com/users/ericelliott/followers","following_url":"https://api.github.com/users/ericelliott/following{/other_user}","gists_url":"https://api.github.com/users/ericelliott/gists{/gist_id}","starred_url":"https://api.github.com/users/ericelliott/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ericelliott/subscriptions","organizations_url":"https://api.github.com/users/ericelliott/orgs","repos_url":"https://api.github.com/users/ericelliott/repos","events_url":"https://api.github.com/users/ericelliott/events{/privacy}","received_events_url":"https://api.github.com/users/ericelliott/received_events","type":"User","site_admin":false},"created_at":"2018-03-12T21:52:08Z","updated_at":"2018-03-12T21:52:08Z","author_association":"NONE","body":"In old versions of Chrome, that v4 UUID algorithm has a disturbingly high collision rate, even on one machine.\r\n\r\nThe issue was [patched in 2015](https://v8project.blogspot.com/2015/12/theres-mathrandom-and-then-theres.html), but if you're supporting old environments, [you should be aware of it](https://medium.com/@betable/tifu-by-using-math-random-f1c308c4fd9d), and you should double check that the vulnerability does not exist in any of your supported environments.\r\n\r\nEven with a better implementation, you'll still run into [birthday paradox problems](https://en.wikipedia.org/wiki/Birthday_problem) if you add distributed id generation to the mix, because as you add id generating hosts, you lose entropy exponentially for simultaneously generated ids (PSRNGs typically use system time as a random seed - as the number of simultaneous hosts climbs linearly, chances of collisions rise exponentially).\r\n\r\nThe question you need to ask yourselves is, \"what are the consequences of a collision?\"\r\n\r\nAre those consequences easier to deal with that maintaining a fork of something like cuid?\r\n"}}
{"actor":{"display_login":"ericelliott"}}