Hacker News new | ask | show | jobs
by pclmulqdq 796 days ago
I have seen a lot of interesting and funny RNG issues, but this is one of the most sophisticated exploits for the least payout. A wonderful work of art.
2 comments

If they had sold the items they could have probably made some money (maybe $1000s?). Still a small payout considering the amount of work, of course.
You can make much more by selling items on 2b.

This is not little payout, it sounds to me like one of the most significant exploits in anarchy minecraft history, possibly even more than nocom.

RNG vulnerabilities are usually really bad in terms of the systems they compromise. It often means exposure of keys, huge numbers of jailbroken devices, or something similar. Making at most tens of thousands of dollars in Minecraft with one is sort of cute and fun in comparison.

Of course, I could be underestimating this by a lot.

This is a bug in how Minecraft does things, not a bug in the generator itself (which has long been known to be vulnerable to such things).
If "random" implies "contains no information", then it is indeed a bug in anything calling itself a "random number generator".

But that's just my opinion. The world is free to use the word however it wants.

“Random” means something closer to “contains maximal information”…
Yeah, there is a big class of "RNG bugs" where someone uses a non-cryptographic RNG for secure things, not realizing that those things are supposed to be secure.

The classic example of these is a password manager that gave out recovery codes using a PRNG. This is in that class.

While a CSPRNG would have solved this problem, it also would've created a new one: much slower chunk loading and random item placement, which would have greatly slowed down the game simulation, and thus tanked framerate and playability. As it turns out, the right solution is to use multiple, isolated non-cryptographic random number generators with distinct state. That way, even though you can guess the state of one of them, it doesn't give you any insight into the others.
Indeed! I love seeing how the seemingly innocuous decisions by Mojang devs are being abused here, so freaking cool.