spetz commented on code in PR #4076:
URL: https://github.com/apache/iggy/pull/4076#discussion_r3945167342
##########
foreign/java/java-sdk/src/main/java/org/apache/iggy/serde/BytesSerializer.java:
##########
@@ -340,7 +339,9 @@ private static long batchChecksum(
*/
private static byte[] encodedMessageId(MessageId id) {
if (id.toBigInteger().signum() == 0) {
- return readAllBytes(new
UuidMessageId(UUID.randomUUID()).toBytes());
+ byte[] minted = new byte[16];
+ ThreadLocalRandom.current().nextBytes(minted);
Review Comment:
`ThreadLocalRandom` has only 64 bits of random state per thread. Producing
16 bytes does not preserve UUIDv4’s collision resistance across JVMs. Please
use a generator with at least 128 bits of independently seeded state, or pooled
`SecureRandom` bytes
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
