Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Hoist – Zapier for Developers (scripting done in Node.js)

hoist.io

Post reply on HN
Print view View original

11–12 of 12 posts

Re: Show HN: Hoist – Zapier for Developers (scripting done in Node.js)

#11

Post by buildmaster »

nikolay wrote: post #9
buildmaster wrote: post #6

Earlier quoted context omitted.

it's not user id but actually just a random number. it's unrelated to your ID (which are actually more complex than just integers). The random number is there just to ensure we don't get collisions on slugs.

This is a pretty bad practice. You should use hashids [0] for this, instead! [0] http://hashids.org/

I should also add that we don't use the URL for any kind of security/lookup. we rely on other information for that. as such the aim is to give readable canonical urls to your application, much like most apps use a /{username} slug

Re: Show HN: Hoist – Zapier for Developers (scripting done in Node.js)

#12

Post by nikolay »

buildmaster wrote: post #10
nikolay wrote: post #9

Earlier quoted context omitted.

This is a pretty bad practice. You should use hashids [0] for this, instead! [0] http://hashids.org/

thanks for the link, I agree it's bad practice if there's any kind of lookup/security based on the slug. We have a few other mitigations against looking up anything security wise from the slug itself. but will take it into consideration as I agree it increases guess-ability of the slugs and could leave us open in future.

It's just an eyesore. If I see some random ID, I won't be bothered, but to see my name with some suffix to it - it's ugly and not a common practice anyway. There are better ways to generate unique IDs and hashids make them pretty short as well (shorter than their numerical counterparts, I mean).
Post reply on HN