3 ms·
There is a difference between generating these kind of IDs and writing the generator for these kinds of IDs. You shouldn't be rolling your own UUID generator if
by mreome 6y ago
There is a difference between generating these kind of IDs and writing the generator for these kinds of IDs. You shouldn't be rolling your own UUID generator if you don't fully understand the concerns/requirements in regards to your source of randomness.
Generally speaking, I'd agree the need for a cryptographicly secure random is niche in that it is limited to the implementation of specific libraries/functions that despite being widely used, should NOT be frequently re-implemented.
- josephg 6y agoI do this in nodejs all the time for IDs: require(‘crypto’).randomBytes(15).toString(‘base64’) Is this bad practice? Can you say more about why?
- cperciva 6y agoThat's only 120 bits of entropy, which means that you'll get a collision after generating ~ 2^60 IDs. Ok, maybe you're not worried about that scale; but I normally recommend 256-bit IDs in order to make sure that you don't need to worry about that possibility.