garethclose.com

But still, why aren’t they doing it cheaper?

Bluntly because “total cost of operation” (TCO) is more than just the compute.Sure I could just “spin up a VM and do it all myself” but then I’m doing it all myself. I’m suddenly in the realm of patching.

What’s the challenge?

There are three sets to consider in this: The Absolute Keyspace: without any knowledge of the identifiers, the number of combinations?The Available Keyspace: if the ID has constraints, how many valid combinations are there?The Effective Keyspace: if we know anything more, how many combinations are applicable?A good security identifier should make discerning the differences between these difficult: it should involve.

Is this feasible?

So without knowing anything about the ID, there are 10 trillion combinations to check.Python can attempt to open a PDF with a password around 150 times per second.

How does this help us?

The Z check digit reduces the key space by a factor of 10: we “only” have to brute-force for the first 12 digits, and calculate the 13th.Since A is unspecified, we will leave its cardinality unchanged at 10.The C citizenship status can be 0, 1, or 2.

What did we gain?

The system was faster, and even more usefully to operators, more predictable.Once processing had started you could tell, based on the file size, when the items would be ready…Much like “lower p90 but higher maximum” feels better for user experience, this consistency was great.