Hacker News new | ask | show | jobs
by nikolay 704 days ago
I consider anything that's not public knowledge to be a secret. When possible, try not to come up with anything that's guessable. I randomize even DB usernames in Terraform, not just the passwords. I do the same with schema names, etc. This requires sweat and tears, but it's always worth it. WordPress sucks, but the idea to have a custom table name prefix is not random, but a security consideration. But don't prefix field names the same way, please! :D
1 comments

Protip: Use random suffixes not prefixes, and you can retain tab completion.

The frobnicator service can get a database account name frobnicator_znwxhs1xehhoy. You can use a table name like accounts_c4acou45cbkre if you want.

I guess what beats suffixes is infixes. :D

Fun story: I worked with a DBA who used nearly random table and field names - nonstandard abbreviations, unnatural reordering, weirds prefixes and suffixes. He didn't do it for security purposes though - he wanted us devs to always depend on him to decode those newly-added tables and fields. Although he wasn't busy (you can always see him browse eBay for Oakley sunglasses and investing in expensive Costco wines he would later sell when the price peaks - he wasn't a drinker himself), when we wanted to ask him about a field or table or beg him to write a stored procedure, he would start checking his calendar and schedule a 30-minute or 1-hour meeting at least a week in the future, often 2 or 3, and he managed to discipline us to stop asking why so further in the future by making scenes regarding how busy he is! He also persuaded our CEO to buy the super expensive ERwin (an ERD modeler), and we were getting rejecting on Visio and other products at the same time. The early 2000s were fun times!