Math.random() algorithm

**Johannes Baagoe** · Sep 5 '07, 11:35 PM

Re: Math.random() algorithm

Randy Webb :

Makes me glad my hospital and doctors don't identify me by some randomly
generated number.

Well, it is actually a mandatory feature in hospital information systems
in France. The point is that the medical staff must not know whether the
patient is rich or poor, and the accounting staff must not know whether she
or he is going to survive. To sum it up in the most brutal terms.

--
Johannes
"Quand on dit c'est un Johannes, cela vaut autant que ce que maintenant
on appelle un pÃ©dant" (H. Estienne, in Ã‰. LittrÃ©, /Dictionnaire de la
langue franÃ§aise/, art. PÃ‰DANT)

**Randy Webb** · Sep 6 '07, 12:05 AM

Re: Math.random() algorithm

Dr J R Stockton said the following on 9/5/2007 2:36 PM:

In comp.lang.javas cript message <0fOdnWo_n92zsE PbnZ2dnUVZ8sXin Z2d@gigane
ws.com>, Tue, 4 Sep 2007 23:14:38, Johannes Baagoe <baagoe@baagoe. org>
posted:

>Randy Webb :
>>

>>Simply generate a 16 digit number by picking 16 random numbers from 0-9
>>using Math.random() and be done with it.

>Is there a good reason to believe that anybody who does that will always
>come up with a different number from anybody else? Or nearly always, the
>probability of exceptions being demonstrably so small that you would trust
>a system which relies on your solution to operate, e.g., a nuclear plant?

>
There is good reason to disbelieve it, at least in the case of those
using javascript browsers.
>
Since MS IE is so common, there's a fair chance that any given pair of
users are both using it, and therefore will traverse the same sequence
from wherever they start. We do not know how it is initialised, but
it's likely to be from the time-of-day or the time-since-boot. The
chances of one pair of the many(?) users getting, once, the same
initialisation are not IMHO negligible. But greater knowledge of the
internals may rule that out.

And that is precisely why I suggested using a sequential number series.

But here's a thought, not to be taken too seriously - ask the patient to
type in a unique 64-digit number. Ignore the choice of digits, but time
the intervals between them. Each interval, mod 4, should give 2 bits of
near-randomness.

Patient: My head is bleeding profusely.
Admin: Please come type a 64 digit number so I can admit you.

Once Upon A Time, I was friendly with the staff of a computer centre. I
heard that they'd written a business game, to be played each day one
week and scheduled to start at 09:00. I remarked that there was a
chance, with the RNG seeded by the time, that the same random sequence
would be used each day, and seen to be so. While it was agreed that the
chances of that were small, their professionalism caused them to dash
off to exclude the possibility.

Yet you still think a random number poses the best solution versus a
sequential number?

--
Randy
Chance Favors The Prepared Mind
comp.lang.javas cript FAQ - http://jibbering.com/faq/index.html
Javascript Best Practices - http://www.JavascriptToolbox.com/bestpractices/

**Johannes Baagoe** · Sep 6 '07, 12:55 AM

Re: Math.random() algorithm

Randy Webb :

Yet you still think a random number poses the best solution versus a
sequential number?

It does. Among other things, sequential numbers are nowhere anonymous
enough. Forget them.

I cannot possibly post all the considerations that are behind my client's
project. The requirements fill hundreds of pages, with references to
thousands of more general pages of laws, regulations and the like. Please
take my word that anything that obvious as sequential numbers has been
duly considered literally years ago, and if it has not been adopted, there
are quite weighty reasons for that.

Or, more simply, the matter is not for you to decide... sorry. I ask
technical questions about Javascript on comp.lang.javas cript because I am
no expert in that particular language, but please don't tell me how to do
the more general job in which I happen to be an expert. You would waste
your time as well as mine.

--
Johannes
"Quand on dit c'est un Johannes, cela vaut autant que ce que maintenant
on appelle un pÃ©dant" (H. Estienne, in Ã‰. LittrÃ©, /Dictionnaire de la
langue franÃ§aise/, art. PÃ‰DANT)

**Randy Webb** · Sep 6 '07, 01:35 AM

Re: Math.random() algorithm

Johannes Baagoe said the following on 9/5/2007 8:50 PM:

Randy Webb :
>

>Yet you still think a random number poses the best solution versus a
>sequential number?

>
It does. Among other things, sequential numbers are nowhere anonymous
enough. Forget them.

Gives me some fair insight into the thought process of the French.

--
Randy
Chance Favors The Prepared Mind
comp.lang.javas cript FAQ - http://jibbering.com/faq/index.html
Javascript Best Practices - http://www.JavascriptToolbox.com/bestpractices/

**Bart Van der Donck** · Sep 6 '07, 02:45 PM

Re: Math.random() algorithm

Johannes Baagoe wrote:

Randy Webb :
>

>Simply generate a 16 digit number by picking 16 random numbers from 0-9
>using Math.random() and be done with it.

>
Is there a good reason to believe that anybody who does that will always
come up with a different number from anybody else? Or nearly always, the
probability of exceptions being demonstrably so small that you would trust
a system which relies on your solution to operate, e.g., a nuclear plant?
>
My main contract just now is not quite as critical as that. However, it
concerns a hospital for children with quite severe diseases, and if,
say, a prescription goes to the wrong patient, someone could die.

I'm aware of Belgian hospital software where vital data must be
entered twice by independent employees. Making sure not to cut off a
wrong leg or so :)

--
Bart

**Erwin Moller** · Sep 6 '07, 05:05 PM

Re: Math.random() algorithm

Johannes Baagoe wrote:

Randy Webb :
>

>Yet you still think a random number poses the best solution versus a
>sequential number?

>
It does. Among other things, sequential numbers are nowhere anonymous
enough. Forget them.
>
I cannot possibly post all the considerations that are behind my client's
project. The requirements fill hundreds of pages, with references to
thousands of more general pages of laws, regulations and the like. Please
take my word that anything that obvious as sequential numbers has been
duly considered literally years ago, and if it has not been adopted, there
are quite weighty reasons for that.
>
Or, more simply, the matter is not for you to decide... sorry. I ask
technical questions about Javascript on comp.lang.javas cript because I am
no expert in that particular language, but please don't tell me how to do
the more general job in which I happen to be an expert. You would waste
your time as well as mine.
>

Hi Johannes,

Maybe this nonsense, since I didn't read those hundred of pages of
course, BUT:

It is easy to have garantueed uniqueness and arbitrary long random
identifiers on the database.
If is a matter of creating a Primary Key on a table you use for
identifying some record.
You can make this PK as long as suits your needs, and as random as suits
your needs. Good thing is you are on the server, so you can use your
favorite randomgenerator without the hassle in javascript.

That sounds so much more logical and robust than letting Javascript do
this (appearantly important) job.

But then again, maybe I am missing something completely.
Just trying to help out. ;-)

Regards,
Erwin Moller

**Dr J R Stockton** · Sep 6 '07, 06:55 PM

Re: Math.random() algorithm

In comp.lang.javas cript message <J9qdnZMKPoACbE PbnZ2dneKdnZydn Z2d@gigane
ws.com>, Wed, 5 Sep 2007 13:12:47, Johannes Baagoe <baagoe@baagoe. org>
posted:

>
>Cryptographi c security, which is quite hard to attain let alone to prove,
>is not necessarily an issue, AFAICT.

You may not need security against crypto attacks; but you do need
demonstrably good random numbers. Crypto-grade is the best;
javascript/Pascal grade is not, or not demonstrably, good enough; so it
seems worth going for crypto-grade, unless Knuth gives something
adequate in between.

<URL:http://www.merlyn.demo n.co.uk/humorous.htm#Ra ndmight amuse you.

--
(c) John Stockton, Surrey, UK. ?@merlyn.demon. co.uk Delphi 3? Turnpike 6.05
<URL:http://www.merlyn.demo n.co.uk/TP/BP/Delphi/&c., FAQqy topics & links;
<URL:http://www.bancoems.co m/CompLangPascalD elphiMisc-MiniFAQ.htmclpd mFAQ;
<URL:http://www.borland.com/newsgroups/guide.htmlnews: borland.* Guidelines

**Dr J R Stockton** · Sep 6 '07, 06:55 PM

Re: Math.random() algorithm

In comp.lang.javas cript message <jI6dnXqnz9zr3k LbRVn_vw@gigane ws.com>,
Wed, 5 Sep 2007 20:03:49, Randy Webb <HikksNotAtHome @aol.composted:

>
>Yet you still think a random number poses the best solution versus a
>sequential number?

If the details, which we do not know in full, preclude a sequential
number, then a random number is undoubtedly best.

The OP is certainly asking, no doubt for good reason, for a non-
sequential solution; his reason might be as simple as having already a
full understanding of the sequential case.

Hospital numbers should certainly not be incremental - too great a
chance of staff relying on memory. And you might not like to be the
lowest number in a ward running short of bed-space. If they are
generated using a count, then that should be scrambled before issue.

It's probably easier to prove that duplication of long randoms has
negligible probability that it is to prove an equally negligible
probability of a sequential scheme being accidentally would back.

--
(c) John Stockton, Surrey, UK. ???@merlyn.demo n.co.uk Turnpike v6.05 MIME.
Web <URL:http://www.merlyn.demo n.co.uk/- FAQish topics, acronyms, & links.

Food expiry ambiguities: <URL:http://www.merlyn.demo n.co.uk/date2k-3.htm#Food>

**Dr J R Stockton** · Sep 6 '07, 06:55 PM

Re: Math.random() algorithm

In comp.lang.javas cript message <JNOdnY9L5fXpxU Lb4p2dnAA@gigan ews.com>,
Wed, 5 Sep 2007 21:33:25, Randy Webb <HikksNotAtHome @aol.composted:

>Johannes Baagoe said the following on 9/5/2007 8:50 PM:

>Randy Webb :
>>

>>Yet you still think a random number poses the best solution versus a
>>sequential number?

> It does. Among other things, sequential numbers are nowhere
>>anonymous
>enough. Forget them.

>
>Gives me some fair insight into the thought process of the French.

Only into their general nature, which means realising that their refined
sublimity is beyond the comprehension of the average foreigner.

--
(c) John Stockton, Surrey, UK. ?@merlyn.demon. co.uk Turnpike v6.05 MIME.
Web <URL:http://www.merlyn.demo n.co.uk/- FAQqish topics, acronyms & links;
Astro stuff via astron-1.htm, gravity0.htm ; quotings.htm, pascal.htm, etc.
No Encoding. Quotes before replies. Snip well. Write clearly. Don't Mail News.

**Dr J R Stockton** · Sep 6 '07, 06:55 PM

Re: Math.random() algorithm

In comp.lang.javas cript message <mrGdnfsomdzKuU Lb4p2dnAA@gigan ews.com>,
Wed, 5 Sep 2007 17:51:21, Randy Webb <HikksNotAtHome @aol.composted:

>Dr J R Stockton wrote the following on 9/5/2007 7:41 AM:

>In comp.lang.javas cript message <iN-dnUtm0u-efUDb4p2dnAA@gi ganews.com>,
>Tue, 4 Sep 2007 18:50:15, Randy Webb <HikksNotAtHome @aol.composted:

>>Johannes Baagoe said the following on 9/4/2007 1:22 PM:
>>>Erwin Moller:
>>>>
>>>>Personall y I WOULD go serverside if the 'quality' of the random
>>>>numbers
>>>>is important for your current task.
>>> Yes, it does seem to be the only reliable way to go :-(

> If all numbers are issued by a single server, the task is trivial,
>>as
>numbers can be issued in sequence. ISTM clear that the OP needs
>uniqueness in numbers issued by independent, non-communicating machines;
>and AFAICS great randomness is the only possibility for that.

>
>If you want to reply to Johannes you might try replying to his post,
>not mine.

My main interest was in pointing out the errors in your thinking, so
that others should not be deceived.

>If you were one of the patients, would you want your life possibly
>dependent on the possibility of a random number being generated twice?
>I wouldn't.

The chances of your being killed by a small meteor are something like 1
in 10^9. Probably it's not a matter of much concern to you, in
comparison with your national chance of being murdered at 55*10^-6 per
annum. The chance of your personal 32-bit random number matching a
given other person's random number would be about 0.25 in 10^9; and in
this application the number of other persons is probably not much over
1000. So perhaps the total risk is comparable with the risk of a
commercial cross-country flight.

The OP was envisaging using 256 bits, which is about 2^224 times
better.

The *only* way to ensure that is to keep track of what numbers have
>been generated. And the simplest way to do that is to sequentially
>number patients.

When that solution is possible, it is obviously the best. Therefore
there's no need to suggest it to an intelligent OP.

Using sequential numbers rather than long random ones probably gives a
greater risk of error due to system fault or misuse; though in either
case that's the biggest risk.

... ... ... ...

Please read FAQ 2.3.

--
(c) John Stockton, Surrey, UK. *@merlyn.demon. co.uk / ??.Stockton@phy sics.org
Web <URL:http://www.merlyn.demo n.co.uk/- FAQish topics, acronyms, & links.
Correct <= 4-line sig. separator as above, a line precisely "-- " (SoRFC1036)
Do not Mail News to me. Before a reply, quote with ">" or "" (SoRFC1036)

**John G Harris** · Sep 6 '07, 08:55 PM

Re: Math.random() algorithm

On Wed, 5 Sep 2007 at 21:33:25, in comp.lang.javas cript, Randy Webb
wrote:

>Johannes Baagoe said the following on 9/5/2007 8:50 PM:

>Randy Webb :
>>

>>Yet you still think a random number poses the best solution versus a
>>sequential number?

> It does. Among other things, sequential numbers are nowhere
>>anonymous
>enough. Forget them.

>
>Gives me some fair insight into the thought process of the French.

Be fair. Random patient IDs make it unlikely that a small typo will
produce a valid ID, and hence the wrong patient. It also makes hash
tables work more reliably.

John
--
John Harris

**John G Harris** · Sep 6 '07, 08:55 PM

Re: Math.random() algorithm

On Tue, 4 Sep 2007 at 23:14:38, in comp.lang.javas cript, Johannes Baagoe
wrote:

<snip>

>My main contract just now is not quite as critical as that. However, it
>concerns a hospital for children with quite severe diseases, and if,
>say, a prescription goes to the wrong patient, someone could die.

<snip>

The idea of doing life critical calculations in javascript is
horrifying. Are you really going to re-certify the application every
time Microsoft issues an IE update?

John
--
John Harris

**Randy Webb** · Sep 6 '07, 10:45 PM

Re: Math.random() algorithm

John G Harris said the following on 9/6/2007 3:46 PM:

On Wed, 5 Sep 2007 at 21:33:25, in comp.lang.javas cript, Randy Webb
wrote:

>Johannes Baagoe said the following on 9/5/2007 8:50 PM:

>>Randy Webb :
>>>
>>>Yet you still think a random number poses the best solution versus a
>>>sequential number?
>> It does. Among other things, sequential numbers are nowhere
>>anonymous
>>enough. Forget them.

>Gives me some fair insight into the thought process of the French.

>
Be fair.

OK. I just find it odd that a society would think that random numbers,
that have a probability of repeating - no matter how small that chance -
is better than a system where the chance of repeating a number is
impossible.

Random patient IDs make it unlikely that a small typo will
produce a valid ID, and hence the wrong patient.

That is true. And a simple solution exists for that. If you want a 16
digit patient ID, you create a database with those ID'es. You shuffle
that database and then pick random entries from it. As you use an ID,
you remove it from the database.

Either way, it doesn't really matter as the OP has already discounted
that approach.

--
Randy
Chance Favors The Prepared Mind
comp.lang.javas cript FAQ - http://jibbering.com/faq/index.html
Javascript Best Practices - http://www.JavascriptToolbox.com/bestpractices/

**Randy Webb** · Sep 6 '07, 10:55 PM

Re: Math.random() algorithm

Dr J R Stockton said the following on 9/6/2007 10:41 AM:

In comp.lang.javas cript message <jI6dnXqnz9zr3k LbRVn_vw@gigane ws.com>,
Wed, 5 Sep 2007 20:03:49, Randy Webb <HikksNotAtHome @aol.composted:

>Yet you still think a random number poses the best solution versus a
>sequential number?

>
If the details, which we do not know in full, preclude a sequential
number, then a random number is undoubtedly best.

If you think that a random number - with the possibility of repeating -
is better than a system where the possibility of repeating is impossible
then you are welcome to continue to believe that.

The OP is certainly asking, no doubt for good reason, for a non-
sequential solution; his reason might be as simple as having already a
full understanding of the sequential case.

And it could be nothing more than wanting to make something more
difficult than it has to be.

Hospital numbers should certainly not be incremental - too great a
chance of staff relying on memory. And you might not like to be the
lowest number in a ward running short of bed-space. If they are
generated using a count, then that should be scrambled before issue.

It is trivial to remove the sequentiality of the numbers, you simple
Shuffle them. Then you remove ID'es as they are used. You now have no
problem with sequential numbers but you also have *zero* chance of
repeating an ID. That can not be said for random numbers no matter how
small the chance of repeating is, there is always that chance.

It's probably easier to prove that duplication of long randoms has
negligible probability that it is to prove an equally negligible
probability of a sequential scheme being accidentally would back.

YGCIB as that sentence doesn't make any sense.

--
Randy
Chance Favors The Prepared Mind
comp.lang.javas cript FAQ - http://jibbering.com/faq/index.html
Javascript Best Practices - http://www.JavascriptToolbox.com/bestpractices/

**Randy Webb** · Sep 6 '07, 10:55 PM

Re: Math.random() algorithm

Dr J R Stockton said the following on 9/6/2007 11:27 AM:

In comp.lang.javas cript message <JNOdnY9L5fXpxU Lb4p2dnAA@gigan ews.com>,
Wed, 5 Sep 2007 21:33:25, Randy Webb <HikksNotAtHome @aol.composted:

>Johannes Baagoe said the following on 9/5/2007 8:50 PM:

>>Randy Webb :
>>>
>>>Yet you still think a random number poses the best solution versus a
>>>sequential number?
>> It does. Among other things, sequential numbers are nowhere
>>anonymous
>>enough. Forget them.

>Gives me some fair insight into the thought process of the French.

>
Only into their general nature, which means realising that their refined
sublimity is beyond the comprehension of the average foreigner.

YSCIB. If not understanding the idiocy of using a system that is flawed
from the outset is "beyond the comprehension.. ." then I would prefer not
to comprehend it.

--
Randy
Chance Favors The Prepared Mind
comp.lang.javas cript FAQ - http://jibbering.com/faq/index.html
Javascript Best Practices - http://www.JavascriptToolbox.com/bestpractices/

Math.random() algorithm

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment