Hacker News Reader

Hacker News

Comment by zahlman | Hacker News Reader

Parent Full thread

zahlman

> 00000000-1111-2222-3333-444444444444 = { name = "REPLTreeViews", path = "R/REPLTreeViews" }

... Should it be concerning that someone was apparently able to engineer an ID like that?

View on HN

Could you please articulate specifically why that should be concerning?

Right now I don't see the problem because the only criterion for IDs is that they are unique.

I didn't know whether they were supposed to be within the developer's control (in which case the only real concern is whether someone else has already used the id), or generated by the system (in which case a developer demonstrated manipulation of that system).

Apparently it is the former, and most developers independently generate random IDs because it's easy and is extremely unlikely to result in collisions. But it seems the dev at the top of the list had a sense of vanity instead.

You're supposed to generate a random one, but the only consequence of not doing so is that you won't be able to register your package if someone else already took the UUID (which is a pain if you have registered versions in a private registry). That said, "vanity" UUIDs are a bad look, so we'd probably reject them if someone tried that today, but there isn't any actual issue with them.

If you read the repo README, it just says "generate a uuid". You can use whatever you want as long as it fits the format, it seems.

It’s as random as any other UUID.

Incorrect, only some UUIDs are random, specifically v4 and v7 (v7 uses time as well).

https://en.wikipedia.org/wiki/Universally_unique_identifier

> 00000000-1111-2222-3333-444444444444

This would technically be version 2, which would be built from the date-time and MAC address, and DCE security version.

But overall, if you allow any yahoo to pick a UUID, its not really a UUID, its just some random string that looks like one.

> if you allow any yahoo to pick a UUID, its not really a UUID

universally unique identifier (UUID)

> 00000000-1111-2222-3333-444444444444

It's unique.

Anyway we're talking about a package that doesn't matter. It's abandoned. Furthermore it's also broken, because it uses REPL without importing it. You can't even precompile it.

https://github.com/pfitzseb/REPLTreeViews.jl/blob/969f04ce64...

Which is to say, not guaranteed at all. GUIDs are designed to be unique, not random/unpredictable

https://devblogs.microsoft.com/oldnewthing/20120523-00/?p=75...

Reply on news.ycombinator.com