4 ms·

Sometimes I wonder if package names, bucket names, github account names and so on should use a naming scheme like discord. Eg, @sometag-xxxx where xxxx is a ran

by josephg 8mo ago

Sometimes I wonder if package names, bucket names, github account names and so on should use a naming scheme like discord. Eg, @sometag-xxxx where xxxx is a random 4 digit code. Its sort of a middleground between UUID account names and completely human generated names. This approach goes a long way toward democratizing the name space, since nobody can "own" the tag prefix. (10000 people can all share it). This can also be used to prevent squatting and reuse attacks - just burn the full account name if the corresponding user account is ever shut down. And it prevents early users from being able to snap up all the good names.

donmcronald 8mo ago
I just want to be able to use a verified domain; @example.com everywhere.
- Cthulhu_ 8mo ago
  That still has "squatting" risks as described in the original article though, domains expire and / or can be taken over.
  - fc417fc802 8mo ago
    But you already have a domain for whatever you're doing so presumably that's going to be a threat either way. For particularly high risk activities if circumstances permit you can sidestep the entire issue by adding a layer of verification using a preshared public key. As an arbitrary example, on android installing an app with the same name but different signing key won't work. It essentially implements a TOFU model to verify the developer.
rithdmc 8mo ago
I like it for buckets, but adding a four digit code won't help with the package hijacking side of things - in fact might just introduce more typo/hijack potential. It'll just be four more characters for people to typo.
jorams 8mo ago
Notably Discord stopped using that format two years ago, moving to globally unique usernames. Their stated reason[1] for doing so being: > This lets you have the same username as someone else as long as you have different discriminators or different case letters. However, this also means you have to remember a set of 4-digit numbers and account for case sensitivity to connect with your friends. [1]: https://support.discord.com/hc/en-us/articles/12620128861463-New-Usernames-Display-Names https://support.discord.com/hc/en-us/articles/12620128861463...
- juliangmp 8mo ago
  It was honestly a downgrade i ended up just putting the 4 digits I had before at the end of my username cause surprise the name was taken immediately
  - ffsm8 8mo ago
    I haven't logged in since . I wonder if they'll delete my account eventually - as I essentially don't have a username because of that
    - embedding-shape 8mo ago
      > I wonder if they'll delete my account eventually Just some days ago I received warning from Discord that they'll delete my account since I haven't logged in for two years. > Your Discord account has been inactive for over 2 years, and is scheduled to be deleted on $DATE. But don’t worry! Dust off the cobwebs and prevent your account from being deleted just by logging in.
    - jorams 8mo ago
      Your account has almost certainly been assigned a new username already. From the same link: > Starting March 4, 2024, Discord will begin assigning new usernames to users who have not chosen one themselves. If your username still has a discriminator (username*#0000*), Discord will begin assigning you a new, unique username as soon as March 4, 2024. We will try to assign you a unique username that is similar to your current username.
fc417fc802 8mo ago
IMO a better general solution is UUIDs and a petname system, at least as far as chat apps are concerned. For buckets I thought easy to use names was a key feature in most cases. Otherwise why not assign randomly generated single use names? But now that they're adding a namespace that incorporates the account name - an unwieldy numeric ID - I don't understand. In the case of buckets isn't it better to use your own domain anyway?
- coredog64 8mo ago
  Having worked in this space for years, it's not nearly as bad as you think. IaC tools can all look up the accountId/region for the current execution context and you can use SSM Parameters to give you a helpful alias in your code. Also, if you have a bunch of accounts, it's far easier for troubleshooting that the accountId is in the name: "I can't access bucket 'foo'" vs. "I can't access bucket 'foo-12345678901'"
brnt 8mo ago
The .NL gTLD used to work like that for personal registrations (ie individuals without a business registration). $name.NNN.nl where you were allowed to choose the number. It won't surprise you the scheme never caught on and has been decommissioned (you can now register any available domain as an individual as well). The difference is probably few people use a personal TLD, but many use a name on some social media.
- NetMageSCW 8mo ago
  I didn’t think it was possible to have a personal TLD - did you mean a personal domain?
  - brnt 8mo ago
    Well, I guess it's possible now to have a personal TLD, but yes, I meant domain.
- jorams 8mo ago
  Small correction: .nl is a ccTLD, or country code TLD. Not a gTLD, or generic TLD.
somat 8mo ago
The requirement for unique user names is a little strange, I was putting together a small internal tool recently and after a bit of thought decided to use an opaque internal id for users and let the users pick and change their name and secret at will. I think for a larger public service it would make sense to expose some sort of internal id(or hash of it. What bob am I talking to?. but people share the same name all the time it is strange that we can't in our online communities.

by josephg 8mo ago

donmcronald 8mo ago

I just want to be able to use a verified domain; @example.com everywhere.

Cthulhu_ 8mo ago
That still has "squatting" risks as described in the original article though, domains expire and / or can be taken over.
- fc417fc802 8mo ago
  But you already have a domain for whatever you're doing so presumably that's going to be a threat either way. For particularly high risk activities if circumstances permit you can sidestep the entire issue by adding a layer of verification using a preshared public key. As an arbitrary example, on android installing an app with the same name but different signing key won't work. It essentially implements a TOFU model to verify the developer.

rithdmc 8mo ago

I like it for buckets, but adding a four digit code won't help with the package hijacking side of things - in fact might just introduce more typo/hijack potential. It'll just be four more characters for people to typo.

jorams 8mo ago

Notably Discord stopped using that format two years ago, moving to globally unique usernames. Their stated reason[1] for doing so being: > This lets you have the same username as someone else as long as you have different discriminators or different case letters. However, this also means you have to remember a set of 4-digit numbers and account for case sensitivity to connect with your friends. [1]: https://support.discord.com/hc/en-us/articles/12620128861463-New-Usernames-Display-Names https://support.discord.com/hc/en-us/articles/12620128861463...

juliangmp 8mo ago
It was honestly a downgrade i ended up just putting the 4 digits I had before at the end of my username cause surprise the name was taken immediately
- ffsm8 8mo ago
  I haven't logged in since . I wonder if they'll delete my account eventually - as I essentially don't have a username because of that
  - embedding-shape 8mo ago
    > I wonder if they'll delete my account eventually Just some days ago I received warning from Discord that they'll delete my account since I haven't logged in for two years. > Your Discord account has been inactive for over 2 years, and is scheduled to be deleted on $DATE. But don’t worry! Dust off the cobwebs and prevent your account from being deleted just by logging in.
  - jorams 8mo ago
    Your account has almost certainly been assigned a new username already. From the same link: > Starting March 4, 2024, Discord will begin assigning new usernames to users who have not chosen one themselves. If your username still has a discriminator (username*#0000*), Discord will begin assigning you a new, unique username as soon as March 4, 2024. We will try to assign you a unique username that is similar to your current username.

fc417fc802 8mo ago

IMO a better general solution is UUIDs and a petname system, at least as far as chat apps are concerned. For buckets I thought easy to use names was a key feature in most cases. Otherwise why not assign randomly generated single use names? But now that they're adding a namespace that incorporates the account name - an unwieldy numeric ID - I don't understand. In the case of buckets isn't it better to use your own domain anyway?

coredog64 8mo ago
Having worked in this space for years, it's not nearly as bad as you think. IaC tools can all look up the accountId/region for the current execution context and you can use SSM Parameters to give you a helpful alias in your code. Also, if you have a bunch of accounts, it's far easier for troubleshooting that the accountId is in the name: "I can't access bucket 'foo'" vs. "I can't access bucket 'foo-12345678901'"

brnt 8mo ago

The .NL gTLD used to work like that for personal registrations (ie individuals without a business registration). $name.NNN.nl where you were allowed to choose the number. It won't surprise you the scheme never caught on and has been decommissioned (you can now register any available domain as an individual as well). The difference is probably few people use a personal TLD, but many use a name on some social media.

NetMageSCW 8mo ago
I didn’t think it was possible to have a personal TLD - did you mean a personal domain?
- brnt 8mo ago
  Well, I guess it's possible now to have a personal TLD, but yes, I meant domain.
jorams 8mo ago
Small correction: .nl is a ccTLD, or country code TLD. Not a gTLD, or generic TLD.

somat 8mo ago

The requirement for unique user names is a little strange, I was putting together a small internal tool recently and after a bit of thought decided to use an opaque internal id for users and let the users pick and change their name and secret at will. I think for a larger public service it would make sense to expose some sort of internal id(or hash of it. What bob am I talking to?. but people share the same name all the time it is strange that we can't in our online communities.