4 ms·

It probably help with recognition. You probably won't remember if you have seen 'b7b05951-c3d3-4a7f-b65b-122e7d2543d4' before, but you are likely to remember th

It probably help with recognition. You probably won't remember if you have seen 'b7b05951-c3d3-4a7f-b65b-122e7d2543d4' before, but you are likely to remember that you have seen 'Cathleen d Dieball the Monolith of Alderson reflects Arly Arnie Keenan and 18 large ants' before (based on the chance that there are no similar uuid) And if also give you something to read in your head when you see it. "Oh, you mean the 18 ants object?"

ponker 6y ago
Hmm, good point. We do refer to UUIDs at the office with things like "Look at the F6A request."
sneak 6y ago
Unless the collision is adversarial. There is a tool that brute forces the generation of SSH server key fingerprints to make the beginning and end look like the one you’re trying to spoof, so someone who knows the first or last few bytes would likely be fooled. The point of the UUID is that it’s got enough entropy to be unique. If you start reducing it to smaller slices of its entropy, it isn’t a UUID anymore. I think projects like this that try to make high entropy things appear more human-manageable do more harm than good.
- phaemon 6y ago
  That doesn't make any sense. There's no such thing as an adversarial collision for UUIDs. They're not hashes and don't have any security at all. If you want to use someone else's UUID, you just can! > If you start reducing it to smaller slices of its entropy Which it doesn't, as has been explained in the comments already several times.
- innocenat 6y ago
  Well, of course. Doesn't change the fact that it allow easier recognition, but you need to double-check it. (Not sure why I need to explicitly state that)
- dogma1138 6y ago
  UUID’s should not be used for “security” they aren’t hashes, or suited to be used as encryption keys or any thing else. They don’t need to be kept secret as part of their trust model. There should never be a situation in which the disclosure of a UUID breaks the trust or security model of your application your design is wrong.

ponker 6y ago

Hmm, good point. We do refer to UUIDs at the office with things like "Look at the F6A request."

sneak 6y ago

Unless the collision is adversarial. There is a tool that brute forces the generation of SSH server key fingerprints to make the beginning and end look like the one you’re trying to spoof, so someone who knows the first or last few bytes would likely be fooled. The point of the UUID is that it’s got enough entropy to be unique. If you start reducing it to smaller slices of its entropy, it isn’t a UUID anymore. I think projects like this that try to make high entropy things appear more human-manageable do more harm than good.

phaemon 6y ago
That doesn't make any sense. There's no such thing as an adversarial collision for UUIDs. They're not hashes and don't have any security at all. If you want to use someone else's UUID, you just can! > If you start reducing it to smaller slices of its entropy Which it doesn't, as has been explained in the comments already several times.
innocenat 6y ago
Well, of course. Doesn't change the fact that it allow easier recognition, but you need to double-check it. (Not sure why I need to explicitly state that)
dogma1138 6y ago
UUID’s should not be used for “security” they aren’t hashes, or suited to be used as encryption keys or any thing else. They don’t need to be kept secret as part of their trust model. There should never be a situation in which the disclosure of a UUID breaks the trust or security model of your application your design is wrong.