221: Random Number

Random Number

|< < Prev #221 (February 9, 2007) Next > >|

Title text: RFC 1149.5 specifies 4 as the standard IEEE-vetted random number.

|< < Prev Random explanation Next > >|

Explanation

This is one of 65 incomplete explanations: Expand on the eMudhra incident in the #Trivia. Maybe it should even move out of the trivia? Also, discuss random vs pseudorandom number generation. You can help by editing the explanation!

The comic contains computer code specifying a function (in a syntax similar to that of C). The int in the function signature promises that the function returns an integer (whole number). The return value is passed back to whatever called this function, so that the result can be used as part of a computation or decision. Judging by its name, it should be designed to return a random number. However, in reality, getRandomNumber() always simplifies entirely non-randomly to the number 4. Most functions with similar names are random number generators, meaning that on subsequent calls they are most likely to return different random numbers, but this function just returns the same number each time.

The code comments, indicated by // characters, state that this is a random number because it was selected by rolling dice. While this would produce a near-random selection at the time of the dice roll, in hard-coding the value in it has been made completely predictable and deterministic, and of no use at all as a random number generator. (We also don't know how many possible values it could have generated, since the code doesn't tell us how many dice were used, or how many faces each had — even if the code was manually updated with the result of a roll between each time the program was run, it may not generate values within a sufficient range for the intended purpose.)

This could be seen as making fun of what many people incorrectly consider 'random numbers'. A mathematician will (or at least should) think about a random number as one that is independent of something (usually being independent of the next number in a list of numbers). However, the average person will often think of a list of random numbers as just 'having no pattern', with options being well-spaced and evenly distributed. This difference is described in an MIT koan. In some media players, the shuffle algorithm is not truly random, because true randomness can output clusters of similar or related tracks that don't 'feel' as random as they are.

Just to drive this point home, if the first number of a list is "4", and the second number is independent of the first, then that means the second number can also be "4" (and so can the third, the fourth, and so on). This obviously creates a 'pattern', while still being random because each result is independent. Four times "4" in a row is not a likely outcome for dice rolls, with a probability of ${\left(\frac{1}{6}\right)}^4$ or approximately 0.08%. It is much more likely, for instance, to find at least one "4" among the four dice rolls ($1-{\left(\frac{5}{6}\right)}^4$ ≈ 51.8%), or a "4" only on the first roll ($\frac{1}{6}$ ≈ 16.7%). All three outcomes are, however, possible.

The IEEE is the organization responsible for maintaining a number of computer standards. An RFC, or Request for Comments, is a formal document put out to computing experts by IETF in the hopes of becoming a future standard. However, RFC 1149 was an April Fools' joke, IP over Avian Carriers, defining how carrier pigeons can be used to transmit Internet packets. "RFC 1149.5," meanwhile, simply does not exist.

Trivia

• The well-known "helper website" (CyberChef) has a function that simulates XKCD's program.
• Esolangs.org features a challenge that requires you to rewrite the program in XKCD's comic in another programming language, as either a function or a full program that prints the "4".
• Security Researchers made AMD Zen CPUs return 4 when called for randomness via a microcode update
• Cryptographic keys are effectively just very large random numbers. If the random number generator creates predictable values that can easily be guessed, those keys become insecure, because an attacker can impersonate the key owner. Since the comic was released, several security incidents came to light that were caused by predictable random numbers:
  • From 2006 to 2008, Debian (and related Linux distributions) used OpenSSL versions with a defective random number generator (CVE-2008-0166). As a result, a lot of generated private keys were insecure and had to be exchanged. Randall himself was affected as well and reacted to this incident in 424: Security Holes.
  • In 2026, 8 of HTTPS certificate authority eMudhra's intermediate private keys were discovered to be integers less than 256. One of them was "4". This is very insecure; knowing these private keys allows a man-in-the-middle on the local network to impersonate any website. 3314: Vulnerability refers to this incident in the title text.

Transcript

[A computer program.]

int getRandomNumber()
{
   return 4; // chosen by fair dice roll.
             // guaranteed to be random.
}

  Add comment 

Discussion

The syntax looks like perfectly valid java to me.213.64.1.189 22:00, 11 March 2013 (UTC)

Looks like Java to me too. 139.216.242.254 (talk) 06:35, 16 August 2013 (UTC) (please sign your comments with ~~~~)

How can Java come to mind when it is pure C syntax, which predates Java by several years and is arguably better known. A feature of most languages is that they have a "C-like syntax". See, a whole page on Wikipedia - http://en.wikipedia.org/wiki/List_of_C-based_programming_languages 122.161.20.238 19:53, 22 August 2013 (UTC)

"C-like syntax" is the best explain, this covers all. Even when I disagree that it's better known than Java these days.--Dgbrt (talk) 21:04, 22 August 2013 (UTC)

Just to be particularly pedantic, the double slash for the comment (which is generally utilised in object oriented C-style languages) should be avoided in C to retain backwards compatibility with C89, although it's a valid construct in C99. I'd offer, too, that the lack of library inclusion suggests this isn't necessarily Java, though it's been a couple years since I've had the opportunity to code in it. Thokling (talk) 15:35, 20 September 2013 (UTC)

Not really worth putting effort in backward compatibility for stuff a simple regex can fix:
$ perl -pi.bak -e 's!//(.*)$!/\*$1\*/!' *.c 108.162.229.210 03:23, 5 August 2015 (UTC)

Java code for this would be something like "public static int fin(){}" or just "public int fin(){}". I think the code would still compile though without the public/private part. 188.114.106.41 (talk) 00:44, 8 June 2015 (UTC) (please sign your comments with ~~~~)

I know this comment is from several years ago, but I'll add this just for posterity. The "default" access modifier exists in java and is somewhere in between "private" and "protected". You can only use it by otherwise unspecifying the access modifier.108.162.215.187 16:40, 18 July 2016 (UTC)

To keep up with the tradition to answer year old posts, the method would be "package visible", i.e. all classes in the same package can see and access this method.Kimmerin (talk) 15:18, 27 January 2022 (UTC)

As a proof of good joke, RFC 1149 was successfully implemented several times. -- Hkmaly (talk) 08:55, 11 May 2013 (UTC)

Actually, a poor “random” function like “return 4;” would be quickly determined by statistical test tools (Diehard, Dieharder, etc.) to generate very poor random number. Samiam (talk) 19:55, 28 October 2013 (UTC)

The number is random, I'm sure Randall really did this "fair dice roll". And even the name of the function is correct, it just returns a random number. A programmer would expect a random number generator, but Randall can't roll the dice all the time.--Dgbrt (talk) 21:37, 28 October 2013 (UTC)

<<sound of crickets chirping>> 108.162.219.58 02:24, 6 February 2014 (UTC)

Isn't this a reference to Sony Playstation 3's random number generator function that allowed to discover the private key to 3.55 firmware? 141.101.64.23 (talk) 01:03, 22 August 2014 (UTC) (please sign your comments with ~~~~)

The comic is from February 9, 2007. The 3.55 firmware was released December 7, 2010. 173.245.50.144 (talk) 14:27, 20 April 2015 (UTC) (please sign your comments with ~~~~)

Maybe the 3.55 firmware implemented RFC 1149.5 --172.70.130.109 20:13, 17 August 2021 (UTC)

This seems to have turned up in SMBC. .42 (talk) 20:00, 18 July 2016 (UTC)

Possibly turned up in Gravity Falls. Journal 3 (book edition) states that the Infinity-Sided Die can theoretically result in any outcome, but "you'd be surprised how often you'd roll a 4." 141.101.76.46 04:18, 19 October 2018 (UTC) Unknowingly or not, this could very well be related to the gif spec. https://www.w3.org/Graphics/GIF/spec-gif89a.txt

In the graphic control extension part of gif89A, a block size is allowed to be specified. And well... I'll just let the spec speak for itself:

iii) Block Size - Number of bytes in the block, after the Block
Size field and up to but not including the Block Terminator.  This
field contains the fixed value 4.

~ 172.70.34.91 (talk) 02:40, 2 January 2022 (UTC) (please sign your comments with ~~~~)

me: rolls a die

die: 4 An user who has no account yet (talk) 13:36, 5 September 2023 (UTC)

Rewatching Futurama again, I just noticed the season 2 episode "When Aliens Attack" (airdate 7 November 1999) has a throwaway line said by a news anchor: "Once again, today's winning lotto number was four." Wonder if this inspired Randall, or if 4 really is the standard random integer of our universe. 108.162.245.15 19:54, 2 July 2022 (UTC)

i have a game that i've played once where i repeatedly open a random xkcd comic until i get one i've already seen because xkcd apparently really, REALLY likes showing me comics i've already seen 3 seconds after i've seen them. anyway, my chromebook almost crashed when i did because it decided to spice up its game a little and give me no dupicate comments, thank you Me^{[citation needed]} 06:18, 9 October 2023 (UTC)

this comic just keeps aging like a fine wine... 12.168.100.2 19:16, 15 October 2026 (UTC)

indeed it does: today it was discovered that a CA (eMudhra) had used '4' as a private key... (compromised keys were: 4, 56, 66, 115, 155, 156, 230, 237) BertieB (talk) 22:06, 20 October 2026 (UTC)

we live in a simulation 2001:1C00:31D:E200:0:0:0:7E 09:23, 22 October 2026 (UTC)

hold on, i thought the key compromise was initially discovered on October 17 (by security researcher Wayne)? Was this comment prescient, was the security problem known earlier already, or is this about something else? 2A02:2454:FF20:C400:A782:12DE:2EF7:3FC5 21:00, 21 October 2026 (UTC)

I thought for the last 18 years that this comic was a response to CVE-2008-0166 (the Debian predictable RNG SSL debacle). Just found out that this comic released over one year earlier (while the flaw was already in-place since 2006 in Debian's SSL library). I remember that back then, this comic was heavily distributed. I think I'll add that in the trivia section as well. --Codux 2A02:2761:231C:A00:8B0:621B:DF53:604A 22:28, 23 October 2026 (UTC)
        Add comment