{"action":"created","issue":{"url":"https://api.github.com/repos/dominikh/go-tools/issues/622","repository_url":"https://api.github.com/repos/dominikh/go-tools","labels_url":"https://api.github.com/repos/dominikh/go-tools/issues/622/labels{/name}","comments_url":"https://api.github.com/repos/dominikh/go-tools/issues/622/comments","events_url":"https://api.github.com/repos/dominikh/go-tools/issues/622/events","html_url":"https://github.com/dominikh/go-tools/issues/622","id":505912618,"node_id":"MDU6SXNzdWU1MDU5MTI2MTg=","number":622,"title":"staticcheck: warn when program uses rand without seed","user":{"login":"bboreham","id":8125524,"node_id":"MDQ6VXNlcjgxMjU1MjQ=","avatar_url":"https://avatars2.githubusercontent.com/u/8125524?v=4","gravatar_id":"","url":"https://api.github.com/users/bboreham","html_url":"https://github.com/bboreham","followers_url":"https://api.github.com/users/bboreham/followers","following_url":"https://api.github.com/users/bboreham/following{/other_user}","gists_url":"https://api.github.com/users/bboreham/gists{/gist_id}","starred_url":"https://api.github.com/users/bboreham/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bboreham/subscriptions","organizations_url":"https://api.github.com/users/bboreham/orgs","repos_url":"https://api.github.com/users/bboreham/repos","events_url":"https://api.github.com/users/bboreham/events{/privacy}","received_events_url":"https://api.github.com/users/bboreham/received_events","type":"User","site_admin":false},"labels":[{"id":525936443,"node_id":"MDU6TGFiZWw1MjU5MzY0NDM=","url":"https://api.github.com/repos/dominikh/go-tools/labels/needs-decision","name":"needs-decision","color":"bfdadc","default":false},{"id":693024929,"node_id":"MDU6TGFiZWw2OTMwMjQ5Mjk=","url":"https://api.github.com/repos/dominikh/go-tools/labels/new-check","name":"new-check","color":"84b6eb","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2019-10-11T15:16:36Z","updated_at":"2019-10-11T22:30:40Z","closed_at":null,"author_association":"NONE","body":"Example program: https://play.golang.org/p/RbLQ-MOqOm0\r\n\r\n(this is from a real-world fail but I don't like to point at the location)\r\n\r\nIn Go 1.12 and 1.13 (at least), `rand.Intn(5000)` is 3081.  Every time.\r\nThe programmer should have done something like `rand.Seed(time.Now().UnixNano())` to make it come out different each time.\r\n\r\nI see there would be false positives when library code doesn't want to impose a seeding policy. Or test code that really does want the same random numbers each time."},"comment":{"url":"https://api.github.com/repos/dominikh/go-tools/issues/comments/541245197","html_url":"https://github.com/dominikh/go-tools/issues/622#issuecomment-541245197","issue_url":"https://api.github.com/repos/dominikh/go-tools/issues/622","id":541245197,"node_id":"MDEyOklzc3VlQ29tbWVudDU0MTI0NTE5Nw==","user":{"login":"dominikh","id":39825,"node_id":"MDQ6VXNlcjM5ODI1","avatar_url":"https://avatars0.githubusercontent.com/u/39825?v=4","gravatar_id":"","url":"https://api.github.com/users/dominikh","html_url":"https://github.com/dominikh","followers_url":"https://api.github.com/users/dominikh/followers","following_url":"https://api.github.com/users/dominikh/following{/other_user}","gists_url":"https://api.github.com/users/dominikh/gists{/gist_id}","starred_url":"https://api.github.com/users/dominikh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dominikh/subscriptions","organizations_url":"https://api.github.com/users/dominikh/orgs","repos_url":"https://api.github.com/users/dominikh/repos","events_url":"https://api.github.com/users/dominikh/events{/privacy}","received_events_url":"https://api.github.com/users/dominikh/received_events","type":"User","site_admin":false},"created_at":"2019-10-11T22:30:40Z","updated_at":"2019-10-11T22:30:40Z","author_association":"OWNER","body":"I don't think we can flag this without causing annoying false positives, for the reasons you have mentioned, plus for the reason that any imported package may seed it for us as well. IOW, it's a whole-program analysis.\r\n\r\nAt best we might restrict the analysis to non-test code in package main, and also analyze every transitive dependency for whether it might seed the RNG. That's both very specific (unlikely to find many bugs due to the restrictions) and very expensive. I'm not sure it's worth implementing a check with those restrictions."}}
{"actor":{"display_login":"dominikh"}}