Hacker News new | ask | show | jobs
by davisp 714 days ago
Worrying about UUID collisions is like worrying about being hit in the head by a meteor. Sure, its technically possible, but it happens so rarely that worrying about a collision as a performance concern is just a misunderstanding on how UUIDs work.

And, it’s so random that if you ever do see a collision you should immediately start looking for a compromised system or bug. This is basically how GitHub discovered the OpenSSL bug that had removed too much entropy from the RNG setup.
1 comments
kevincox 714 days ago
You don't need to worry about a collision in a UUIDv4 that you created on your server. But I have seen a surprising number of applications that took a UUID generated client side and basically upserted it. Allowing taking over resources who's ID was known via the insert API (even if the update API has proper access control).
link
groestl 713 days ago
> UUID generated client side and basically upserted it

Read and take notes. This is crazy in untrusted environments.

link
kevincox 713 days ago
Generating IDs on the client can be very useful for offline-first systems. But you need to check for conflicts and permissions on the server (or be sure to keep the IDs secret which I wouldn't recommend).
link
groestl 713 days ago
Agreed, but in that case "upsert" is also weird, since I'd structure such a system around an immutable log datastructure.
link