6 ms·
Just use v7. Cue the security experts who say otherwise…
by MrDarcy 2y ago
Just use v7.
Cue the security experts who say otherwise…
- wongarsu 2y agoUse v4 if creation date could conceivably be sensitive information of if you depend on your uuids being completely unguessable. Otherwise use v7
- stavros 2y agoIf we want a v7, shouldn't we use a ULID instead?
- wongarsu 2y agoWhen we didn't have UUIDv7, ULID was great. But now that we have v7 it's the more widely supported alternative. And apart from v7 setting the UUID version bits and having a different default representation they are not that different.
- stavros 2y agoOh, I didn't realize v7 was newer than ULID, thanks.
- 6512398 2y agoBe careful if you're using python. The python uuid standard library doesn't have V7 yet, and there is a package called uuid7 which is unmaintained, and not in compliance with the latest standard. That's using nanosecond time precision rather than millisecond, which means the leading bits are larger than they are meant to be. If you use that unmaintained uuid7 package and later change to the correct implementation your uuid7 will go backwards, which is a breaking change considering that monotonicity is a key property of uuidv7.
- bruce511 2y agoI believe your concern, while valid, only affects systems which are currently adding records faster than 1 per nano-second on occasion. Also while technically true - it could technically break monotonicity (records added in the same nanosecond could be out of order) they'll still be all "near the end of the file, likely in the same page" such that performance implications are negligible. As a general rule I would avoid any program making any assumptions about a uuid. Programs should treat it as an opaque binary random value. Doing so avoids any future incompatibilities.
- eropple 2y agoULID's presentation format is probably better for humans, though. You can double-click-to-highlight a ULID; the standard UUID representation doesn't like this. (You can use ULID's presentational tools with UUIDv7, though.)
- wtetzner 2y ago> the standard UUID representation doesn't like this. Yeah, I've gotten in the habit of stripping hyphens from the string representation of UUIDs in a lot of the code I write for that reason.
- beart 2y agoIt doesn't help in other tools, but there is a css rule to help with this. https://developer.mozilla.org/en-US/docs/Web/CSS/user-select https://developer.mozilla.org/en-US/docs/Web/CSS/user-select
- Lammy 2y ago> You can double-click-to-highlight a ULID; the standard UUID representation doesn't like this. You can control this behavior in CSS with `user-select`. Peep my fiddle: https://jsfiddle.net/gLyph5km/ https://jsfiddle.net/gLyph5km/
- eropple 2y agoYup, in a browser you can. In my terminal or my text editor or Slack, I can't.
- fiddlerwoaroof 2y agoAn issue I've always had with UUIDs and ULIDs is there isn't a great way to generate one deterministically, as far as I can tell: for a lot of use-cases, being able to reprocess data and generate identical IDs is really useful and there isn't a standard way that I know of to achieve this.
- exe34 2y agohttps://stackoverflow.com/a/64229385 https://stackoverflow.com/a/64229385
- fiddlerwoaroof 2y agoSure, there are workarounds in various languages, but it would nice to have a standardized hash-based UUID or ULID
- 1986 2y agofrom the article, it sounds like this is V5?
- fiddlerwoaroof 2y agoI missed that because I typically am using ULIDs these days. But, yeah, some standardized format for a hash of message data is what I want.
- IggleSniggle 2y agoIf it's a standardized sequence, then that's no different than just 0, 1, 2, 3 but with different names. If you just want a non-sequential but deterministic sequence, then that's every random number generator that accepts a seed value, and being anymore standardized than that makes zero sense.
- fiddlerwoaroof 2y agoThe problem with autoincrement in this context is you can’t reproduce the right value when replaying the input streams for your stream processing job. Hashing some combination of values and using that as a primary key solves this problem nicely and, when you’re using bitemporal data modeling, makes it easy to correct mistakes. The point of standardization is compatibility, not standardizing the sequence of keys used.
- treve 2y agoWhy are you dismissive of security-related issues?
- tonetegeatinst 2y agoBecause developers don't always consider the security aspect. Not saying this is what he's doing but could also just be due to how complex good software can be to write. Their is a reason cybersecurity or UI/UX or product design isn't always left to the developer. The coder write code that fits certain criteria they are given, then someone down the line might QA check it, fuzz inputs or security review the code. How well this is done depends on the product,market, and environment.
- sgarland 2y agoBecause at least half if not more of the industry sector is charlatans. Similar to how devs love to work on new shiny tech, regardless of its actual applicability to their needs, security folk will often insist that X is insecure due to absurdly unlikely edge case wherein you’re already pwned anyway, while ignoring some basic problem in their org.
- elric 2y agoThat doesn't mean that it's not a valid concern in some cases, and it's good to be aware of it. When you're building something, and need a UUID, and stop think "v7 seems useful, but wait, wasn't there a security thing?", that's a win. Even if the answer turns out to be "not a problem in this case".
- MrDarcy 2y agoI’m not dismissive of security related issues. My comment was a snarky reference to some other HN comments on uuid7 some time ago which I’m having trouble finding now. The comment was lamenting developers using uuid7 for many things, presumably without thought, creating loads of security issues for them. In most cases creation time is not sensitive. Therefore, for most cases uuid7 is the best trade off currently.