Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Givemeguid.com – CLI/curl friendly GUIDs

givemeguid.com

Post reply on HN
Print view View original

41–50 of 51 posts

Re: Show HN: Givemeguid.com – CLI/curl friendly GUIDs

#41

Post by oefrha »

berkes wrote: post #32
trashburger wrote: post #12

Earlier quoted context omitted.

In what world is it safe to rely on an external service to provide GUIDs for you? Where's the guarantee that the service won't one day start manipulating GUIDs? Now you have a major attack vector.

> major attack vector That seems hyperbolic to me. If you rely on UUID for security , it seems, to me, something is wrong in your architecture and the security flaw lies there. When would you, legitimate, rely on GUID/UUID for security?

You can totally use uuid4 as password reset tokens, and they could be slightly nicer than random urlsafe strings for your database, provided they’re generated securely, not from givemeguid.com.

Re: Show HN: Givemeguid.com – CLI/curl friendly GUIDs

#44

Post by deweyair »

tkfu wrote: post #3

I'm having trouble imagining who would want to use this. What's the environment where you would have curl and a need for generating UUIDs, but wouldn't have access to uuidgen or similar?

Understandable! I made it for the few times I'm manually testing an API using Swagger or something similar and need a valid(ish) GUID to stand in for some field being sent to the api.

There's no shortage of ways to generate GUIDs, that's for sure!

Re: Show HN: Givemeguid.com – CLI/curl friendly GUIDs

#49

Post by mormegil »

thinkingkong wrote: post #19

If you need a unique identifier on the command line there are a few ways to do it. uuidgen is one. My personal favorite is this snippet. $ id=$(openssl rand 1000 | openssl sha1) && printf "%s${id:0:8}\n"

Why would you want to hash random bytes? The only thing you could theoretically achieve by that would be decreasing entropy. Just do openssl rand -hex 20 (or any other number of bytes as needed, or -base64 for another encoding).

Re: Show HN: Givemeguid.com – CLI/curl friendly GUIDs

#50

Post by tatersolid »

hombre_fatal wrote: post #7
MrGilbert wrote: post #5

Earlier quoted context omitted.

Maybe a JS App which is made completely out of third party APIs, without anything self-hosted? Not discussing wether this is a good idea or not, though... I was surprised to see that there is no "built-in" mechanism in JS to generate a GUID. As a C# dev, I'm used to Guid.NewGuid()

Why would you make an http request if you can just google a 3-line JS solution? You're just generating a large random number and formatting it as a UUID. https://gist.github.com/jed/982883 If you google "generate uuid javascript" you can find approaches from Math.random to node/browser `crypto` module to shelling out OS random. One of the main benefits of guid generation is that you don't need to synchronize with any…

JavaScript Math.random() should never be used for UUID generation. You will get collisions even at small scale.

window.crypto.getRandomValues() should be used instead.

The quality and seeding of Math.random() is implementation-dependent and not generally good enough everywhere to prevent collisions. Many seed with the just the system time.

Source: I have personally seen such collisions in a production web app with 700k users. A Web search for “Javacsript GUID collision” shows that many others have as well. We switched to the cryptographic generator and the collisions disappeared.

Post reply on HN