Sqids – Generate short unique IDs from numbers

Post by [deleted] » Sat, Nov 25, 2023, 11:54 PM UTC

raggi wrote: post #109

parhamn wrote: post #70

Side note: there are some business insights you can get from a company using serial ids. i.e if you sign up and get user id 32588 and make another account a few days later, you can tell the growth rate of the company. And this is possible with every resource type in the application. I do wonder how much the url bar junk thing matters these days. I tend to use uulids (waiting on uuid v7 wide adoption), and they're a b…

I see so many organizations add weird slowdowns from debts associated with this. I reflect on some of the most successful tech businesses of the last decade and remember that all their APIs exposed this kind of data early on and many still do. Does anyone have an example they can reference of a business being harmed by this information being out there?

Post by namtab00 » Sat, Nov 25, 2023, 11:59 PM UTC

leobg wrote: post #114

pacificmint wrote: post #77

Earlier quoted context omitted.

> you can tell the growth rate of the company. You can even do this when you don’t know the exact interval by using probabilities. The Allies used this method to estimate German tank production in World War II by analyzing the serial numbers of captured or destroyed tanks. This is know as the German Tank Problem [1] [1] https://en.wikipedia.org/wiki/German_tank_problem

Very interesting. I’m a lawyer and using sequential IDs in a fraud case right now, to determine the number of victims. Unfortunately, so far, I only have the IDs of two victims, and those are from just within about a month, whereas the fraud has likely been going on for several years. Just simply extrapolating that growth rate isn’t going to be very accurate. Also, I suspect that the perpetrators did not start at ID…

Post by davchana » Sun, Nov 26, 2023, 12:11 AM UTC

noirscape wrote: post #118

sandstrom wrote: post #102

Neat library! We're using randomly generated strings for many things. IDs, password recovery tokens, etc. We've generated millions of them in our system, for various use-cases. Hundreds of thousands of people see them every day. I've never heard any complaints about a random content-id being "lR8vDick4r" (dick) or whatever. But nowadays our society is so afraid of offending anyone, that profanity filters has extended…

There's other "general" rules when it comes to random human-readable tokens such as not using Os and Is if your strings include numbers - people can and will confuse them with 0s and 1s if they have to type them over. Most gift card tokens for example don't allow the use of those two (or quietly correct it) to avoid making that mistake.

Post by wtetzner » Sun, Nov 26, 2023, 12:22 AM UTC

8organicbits wrote: post #71

dumbo-octopus wrote: post #11

Odd design decision in that if you provide your own blocklist, it overwrites their (extensive) default list instead of adding to it. And in general the algorithm is surprisingly complicated for something that could be replaced with simply base64 encoding, the given example (1,2,3) base64 encodes to a string with just one more letter than this algorithm. That said I do appreciate the semicolon-free-style. I don't typi…

The problem is their block list will change over time. If you don't override it, then your IDs won't decode right when you update. This is a huge risk. > You have to account for scenarios where a new word might be introduced to the default blocklist https://sqids.org/faq#future-blocklist Honestly, I think they need to rethink this. Otherwise you've got different library versions for different languages each using dif…

Post by andix » Sun, Nov 26, 2023, 12:30 AM UTC

Mogzol wrote: post #127

andix wrote: post #121

Actually I'm a bit disappointed that it can't format 128 bit integers or byte arrays. That would allow formatting UUIDs. I'm not a huge fan of public facing integer IDs. There is always the risk of leaking some kind of critical information with ascending IDs. So I will probably keep Base64URL formatting my UUIDs to make them shorter for URLs, QR Codes and so on. Quick example: 20b30b32-d421-4cfb-bdbc-9a4e0475abea =>…

Even if it could format 128 bit integers, I don't see how that would be any better than base64-encoding them. Base64 is already pretty close to the maximum efficiency you can get for shortening UUIDs while still using URL-safe characters.