Hacker News Reader

Comment by rootlocus | Hacker News Reader

If you want to learn how UUIDs work, implement the standard.

This isn't about UUIDs. I think the project creator in the OP was just learning lower level things like working with randomness and bytes... I don't see the problem. Experimenting is fun. Leave them alone.

A bad a excuse for a bad library. See this time and time again in NodeJS though.

This is a good library.

However pretty, I wouldn't use something non-standard for generating IDs unless I was doing something embedded which required careful memory management under hardware constraints, where I most definitely wouldn't be using JS.

What? It's just a random string of letters. Don't be afraid of using random strings of letters! You don't need a standard for that.

@dchest So you frequently use varchar for your table index?

Why do you need VARCHAR? If you use SQL, you can use a fix char type to store fixed-length random strings as IDs. If you use SQL which supports native UUID type, sure, go ahead and use it. But the world is not limited to SQL databases or even any databases.

In three project I'm working on right now, two identify objects by content HMAC (one of them uses an SQL database), the other uses a mix of incrementing integers and a random string for different use cases.

> two identify objects by content HMAC (one of them uses an SQL database), the other uses a mix of incrementing integers and a random string for different use cases.

If those two are using SHA-1, like git, you are still using a standard. The third one however sounds like a potential mess.

If those two are using SHA-1, like git, you are still using a standard

Lovely, so I can officially claim I use a standard that is required by many commenters here if I just hash random bytes! Should I use a NIST-approved standard or maybe GOST hash function will work? Can I use the output of ChaCha20? If so, I'll be happy to read 16 bytes from /dev/urandom.

The third one however sounds like a potential mess.

Thanks for your analysis!

> Lovely, so I can officially claim I use a standard that is required by many commenters here if I just hash random bytes!

Stop pretending that you don't understand what a cryptological hash function is, or that using a strong crypto function is the same as rolling your own, or that using the hash function on your input is the same as running it on random bytes.

> Thanks for your analysis!

Thanks for the anecdotal evidence.

The problem is pollution. That's extremely unfun.

Experiments should stay on the developer's personal git repo, but they should not be uploaded to the common code repos as a package. (Maybe into the Acme namespace¹ so that's clear that this code is not serious/can be safely ignored, but unfortunately npm does not support that.)

¹ https://softwareengineering.stackexchange.com/a/221954

I experiment all the time in my spare time. But I don't write blog posts and publish to npm.

Reply on news.ycombinator.com