
Security News
Rust RFC Proposes a Security Tab on crates.io for RustSec Advisories
Rust’s crates.io team is advancing an RFC to add a Security tab that surfaces RustSec vulnerability and unsoundness advisories directly on crate pages.
jittered-fractional-indexing
Advanced tools
Provides functions for generating ordering strings with random jitter to minimize the likelihood of collisions
This package extends rocicorp/fractional-indexing with random jitter functionality to minimize the likelihood of index collisions when generating fractional indices concurrently.
rocicorp/fractional-indexing is in turn based on Implementing Fractional Indexing by David Greenspan. See the original rocicorp/fractional-indexing README for more details.
This package uses rocicorp/fractional-indexing under the hood, and generates jitter by binary splitting the key range until the desired number of bits of entropy is reached. For instance, if one bit of jitter is desired:
midpoint, between the specified lower bound a and upper bound b using the original, unjittered fractional-indexing package.a and the midpoint, or a key between the midpoint and the original upper bound b.This runs in O(jitterBits) time with respect to the underlying fractional-indexing implementation (specifically, for b bits of jitter, we call the original, unjittered implementation of the generateKeyBetween function b + 1 times).
At large (arguably non-human) scale, this jittering mechanism is not extremely efficient. On the flip side, the benefit of implementing jittering in this way is that the underlying fractional indexing implementation does not have to be modified at all. Instead, we can fully defer the fractional indexing logic to Rocicorp's existing, popular, well-tested implementation and keep this package focused solely on adding jittering.
generateKeyBetweenGenerate a single key in between two points, with random jitter.
generateKeyBetween(
a: string | null | undefined, // start
b: string | null | undefined, // end
opts?: {
digits?: string = BASE_62_DIGITS; // optional character encoding
jitterBits?: number = 30; // optional jitter bits count
getRandomBit?: () => boolean = Math.random() < 0.5; // optional custom randomness
},
): string
For cryptographically-sensitive applications, the default Math.random()-based getRandomBit function can be replaced with an implementation that uses Crypto.getRandomValues() (browser) or node:crypto instead. This custom getRandomBit function must return a uniformly-distributed (i.e., 50% chance of a true or false result) boolean for an unbiased key.
To select a more appropriate jitterBits argument for your use-case (it defaults to 30), birthday bounds can be used to estimate the probability of collision, i.e., with $k$ keys and $b$ bits of jitter, the probability of collision is
$$1 - \frac{(2^b)!}{(2^b - k)!(2^b)^k}$$
For example, when $b = 30$ and $k = 10000$, there is a ~4.5% chance of collision. Note that this calculation is specific to $a$ and $b$, i.e., it applies when 10,000 keys are generated at the same time for the same $a$ and $b$, and is not a general probability of collision for all key ranges.
import { generateKeyBetween } from 'jittered-fractional-indexing';
const first = generateKeyBetween(null, null); // "a3MdwWG"
// Insert after 1st
const second = generateKeyBetween(first, null); // "a5mlAoC"
// Insert after 2nd
const third = generateKeyBetween(second, null); // "aAGCU4l"
// Insert before 1st
const zeroth = generateKeyBetween(null, first); // "a2FR3vI"
// Insert in between 2nd and 3rd (midpoint)
const secondAndHalf = generateKeyBetween(second, third); // "a5u4jxwl"
generateNKeysBetweenUse this when generating multiple keys at some known position, as it spaces out indexes more evenly and leads to shorter keys.
generateNKeysBetween(
a: string | null | undefined, // start
b: string | null | undefined, // end
n: number, // number of keys to generate evenly between start and end
opts?: {
digits?: string = BASE_62_DIGITS; // optional character encoding
jitterBits?: number = 30, // optional jitter bits count
getRandomBit?: () => boolean; // optional custom randomness
},
): string[]
import { generateNKeysBetween } from 'jittered-fractional-indexing';
const first = generateNKeysBetween(null, null, 2); // ['a0bNAd5V', 'a1Gbzq0G']
// Insert two keys after 2nd
const afterSecond = generateNKeysBetween(first[1], null, 2); // ['a2fHQHyV', 'a3DmSeLV']
// Insert two keys before 1st
const beforeFirst = generateNKeysBetween(null, first[0], 2); // ['ZyD7f85V', 'ZzFK2gHV']
// Insert two keys in between 1st and 2nd (midpoints)
const betweenFirstAndSecond = generateNKeysBetween(first[0], first[1], 2); // ['a0zsO5CZ', 'a10oyKZK']
FAQs
Provides functions for generating ordering strings with random jitter to minimize the likelihood of collisions
The npm package jittered-fractional-indexing receives a total of 19,591 weekly downloads. As such, jittered-fractional-indexing popularity was classified as popular.
We found that jittered-fractional-indexing demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Rust’s crates.io team is advancing an RFC to add a Security tab that surfaces RustSec vulnerability and unsoundness advisories directly on crate pages.

Security News
/Research
Socket found a Rust typosquat (finch-rust) that loads sha-rust to steal credentials, using impersonation and an unpinned dependency to auto-deliver updates.

Research
/Security Fundamentals
A pair of typosquatted Go packages posing as Google’s UUID library quietly turn helper functions into encrypted exfiltration channels to a paste site, putting developer and CI data at risk.