3 ms·
On average: yes. Always: no.
by sverhagen 7y ago
On average: yes. Always: no.
- tptacek 7y agoAlways no? What's a situation in which you'd be better off with monotonic ids?
- sverhagen 7y agoI never said they were less secure. I said there are situations where they're not really more secure. If I can see in this HTML page that your reply is /reply?id=12345, then it doesn't matter if Hacker News uses integers or UUIDs, if there's a bug in /edit?id=12345 that just lets me edit it without the appropriate security. If we say that UUIDs always make everything inherently more secure, we're doing everyone a disservice. Now, the original discussion was about (1) discovering for read, and not about (2) escalating a read to a write. But if anyone reading this mistakenly takes from it that UUIDs are the way to solve these problems then they will go on optimizing for (1) at the expense of (2).