4 ms·
It does matter who generates them. UUIDs are generally assumed not to collide, since that's extremely unlikely. But if you allow an user to generate them, then
by dale_glass 5y ago
It does matter who generates them.
UUIDs are generally assumed not to collide, since that's extremely unlikely. But if you allow an user to generate them, then they can try various shenanigans such as generating duplicated IDs, generating IDs that might have some sort of special meaning (eg, all zeroes), generating non-random IDs that could degrade performance, or storing some sort of data inside the ID.
- chrsig 5y agoFor that matter, they may not even be trying to do so. Depending on generation method, it can be really easy to generate duplicate uuids from two different processes on the same machine that aren't synchronizing with each other. In general, the other party generating your identifiers takes all the control out of your hands, so you have to start safeguarding against malicious/antagonistic/non-compliant inputs. And lose out on optimizing opportunities (e.g., opting to use a generation method that offers partial ordering)
- dcow 5y agoSo return a 409 and make the user generate a new one. Again, there’s nothing unique to who generates the UUID in this problem provided you validate the UUID which you should be doing anyway.
- iudqnolq 5y agoYou can't tell, given a number, if it was randomly chosen. This could lead to a hash dos for example if you assume your uuid distribution is random.
- dcow 5y agoUse a good hash, then: https://doc.rust-lang.org/std/collections/struct.HashMap.html https://doc.rust-lang.org/std/collections/struct.HashMap.htm....