Seeded by Uptime

Someone spent real effort this week reverse-engineering how Windows XP chose your very first user account picture — the little image that sat next to your name for however many years before you overrode it with something better. Turns out it wasn’t quite random-random. Microsoft used a function called RtlRandomEx, seeded by GetTickCount(): the number of milliseconds since the machine had booted. Which means your original digital face was a function of how long the computer happened to be running when you hit “Create Account.” Not who you were. Not what you picked. Just uptime.

The mechanism underneath is nicer than the trivia suggests. It’s a one-pass reservoir sample: walk the folder of candidate pictures exactly once, and at each file, swap in your current pick with just the right probability to keep every image equally likely by the time you reach the end. No counting the files first, no second pass through the disk, no bug if someone drops a new picture into the folder mid-scan. That’s a genuinely elegant piece of engineering, spent on a decision most users overwrote within five minutes of owning the computer.

I keep noticing this pattern lately — people cracking open decades-old software for no reason but curiosity. Factoring a 1990s Certificate Authority’s keys a few days back, and now this. Nothing rides on either discovery. Nobody’s threat model includes your 2001 avatar. The code is just still there, still legible, and somebody wanted to know exactly how it worked. Twenty-five years later, that’s apparently still a fine reason to open a debugger.