June 28th, 2024

Exploring Randomness in JavaScript

This article compares Math.random() and Crypto.getRandomValues() in JavaScript for generating random values. Despite Crypto being more secure, Math.random() suffices for creating color palettes due to speed and perceived randomness.

Read original articleLink Icon
Exploring Randomness in JavaScript

This article by Ben Nadel explores randomness in JavaScript, focusing on the use of Math.random() versus Crypto.getRandomValues(). While Crypto is considered more secure for generating random values, the author questions if this translates to being more random for their specific use case of creating a color palette utility. The article delves into the differences between the two methods, highlighting how they generate random values and their implications for user experience. The author conducts an experiment to compare the visual outcomes of using Math.random() and Crypto.getRandomValues(). Ultimately, they find that for generating a random color palette, sticking with Math.random() may suffice as it is faster and perceived to be just as random as Crypto. The article emphasizes the subjective nature of randomness and the importance of considering both security and user perception when implementing randomization in JavaScript projects.

Related

Do not confuse a random variable with its distribution

Do not confuse a random variable with its distribution

In probability theory, a random variable and its distribution are distinct concepts. The random variable depends on random outcomes, while the distribution shows variation patterns. Changing variables or probabilities alters distributions. Examples clarify shared distributions with different outcomes, crucial for interpreting probabilities and simulations.

The Magic of Participatory Randomness

The Magic of Participatory Randomness

Randomness is vital in cryptography, gaming, and civic processes. Techniques like "Finger Dice" enable fair outcomes through participatory randomness, ensuring transparency and trust in provably fair games.

Why I Attack

Why I Attack

Nicholas Carlini, a computer science professor, focuses on attacking systems due to a passion for solving puzzles. He categorizes vulnerabilities as patchable or unpatchable, stresses responsible disclosure, and highlights the importance of going public to prevent future exploitation.

The many faces of undefined in JavaScript

The many faces of undefined in JavaScript

JavaScript's handling of undefined values, including null and falsy values, can confuse developers. TypeScript introduces nuances with function arguments and void type. Recommendations suggest treating undefined as null to avoid issues.

Eight versions of UUID and when to use them

Eight versions of UUID and when to use them

The article covers eight versions of UUIDs, detailing their characteristics and best use cases. Recommendations include v4 for random IDs, v7 for sortable IDs, and v5 or v8 for custom data. Some versions have been replaced. The author shares insights and hints at a secretive project.

Link Icon 5 comments
By @jsheard - 5 months
The behaviour of Math.random() is technically browser specific since the algorithm isn't specified, but I think all the big engines have settled on xorshift128+. That's probably good enough for most non-crypto things.

Still, if you want consistent quality and speed across all browsers current and future, you're better off bundling your own PRNG code. That's also necessary if you want a repeatable sequence from a specific seed value, neither of the browser built-in methods support that.

By @blixt - 5 months
I was also exploring randomness in JS at some point and found lots of interesting things! One was that the Alea PRNG algorithm[1] by Johannes Baagøe performed faster on JavaScript's floating point numbers. Another was that Dieharder[2] is a really fun tool to test PRNGs. I also made an attempt at consolidating other PRNG methods which were not great[3] and that led me to other people who had done the same[4].

And finally I tried to make a nicer Dieharder wrapper and a simple PRNG library, but lord knows how relevant it is anymore: https://github.com/blixt/js-arbit

I guess in this archaeological dig I also found how many useful resources on the internet disappear in less than a decade.

[1]: https://web.archive.org/web/20120502223108/http://baagoe.com... (Baagøe's original site is down)

[2]: https://rurban.github.io/dieharder/ (old site is dead, though here's a web archive link: https://web.archive.org/web/20170609075452/http://www.phy.du...)

[3]: https://gist.github.com/blixt/f17b47c62508be59987b (Don't use this)

[4]: https://github.com/nquinlan/better-random-numbers-for-javasc... (this is mainly a mirror of Baagøe's wiki)

By @montroser - 5 months
Here's my favorite deterministic PRNG optimizing for implementation simplicity:

    function random() {
      random._s = random._s || 11224; // seed
      return (random._s = random._s * 16807 % 2147483647) / 2147483646;
    }
Wikipedia says this approach has been around at least since the 1950s.

https://en.wikipedia.org/wiki/Linear_congruential_generator

By @iamsanteri - 5 months
What would be the best way for me to create a truly random approach to sampling from a specified distribution in my Monte Carlo simulator app? In my current MVP Beta app I’m just using Math.random() as I cannot access or install any external libraries. How would you go about implementing something more robust in something like, say, Apps Script (a Google proprietary derivative of JavaScript for cloud apps)?
By @wildrhythms - 5 months
Nice article, and reminds me of my personally most used method: window.crypto.randomUUID()