Question

When Perl 5.8.1 came out it added hash randomization. When Perl 5.8.2 came out, I thought, it removed hash randomization unless an environment variable (PERL_HASH_SEED) was present. It now seems as if I am gravely mistaken as

PERL_HASH_SEED=$SEED perl -MData::Dumper -e 'print Dumper{map{$_,1}"a".."z"}'

Always kicks back the same key ordering regardless of the value of $SEED.

Did hash randomization go completely away, am I doing something wrong, or is this a bug?

Answer 1

See Algorithmic Complexity Attacks:

In Perl 5.8.1 the hash function is randomly perturbed by a pseudorandom seed which makes generating such naughty hash keys harder. […] but as of 5.8.2 it is only used on individual hashes if the internals detect the insertion of pathological data.

So randomization doesn’t always happen, only when perl detects that it’s needed.