Why sha256 hash the user into to get a two character target directory? Wouldn't md5 be much faster and solve the same problem?
Security is not a concern here. It's just literally bucketing ids. Also, this is not needed with modern file systems.
Or, like me, they're drowning in security tooling from corporate and don't want to have to carve out exceptions for md5 usage in each.
With their scheme, collisions are already guaranteed to happen if they have >256 users.
They said:
if you need security don't use md5.
If you don't need security, use something faster than md5.
md5 is neither secure nor fast, why use it at all?
MD5 was designed as a cryptographic hash. It's certainly faster than many other cryptographic hashes, and it's also insecure.
Many, many hashes that are not designed to be cryptographic are 10x or more faster than md5 (e.g. murmur, siphash, xxhash, and many more).
No one thinks security is a component here. Literally everyone in this thread has agreed to that fact.
What's actually kinda dumb is to use any cryptographic hash when security is not needed - there's no need to weigh the tradeoffs between md5, sha, blake, etc. Those hashes are universally slow compared to the likes of xxhash - why not just use that to bin the files into subdirectories? Why limit yourself to the slow subset of hashes if you don't need the specific properties that make them slow?