181–190 of 249 posts
Earlier quoted context omitted.
Can confirm, when I worked in VC we used this to verify order volume for a number of startups we were evaluating. For one startup, I wrote a bot to place a small order a few times a day, and log the order number.
Did you use this for due diligence to verify that the data reported by the entrepreneur in the pitch was good or you were looking at some companies in a specific space and checking the company that has more orders?
Earlier quoted context omitted.
Exactly. An alphanumeric encoding for integers.
An argument could be made for calling it “compression of the string encoding”. Since HTTP is string oriented, that makes some sense as an optimization of sorts, perhaps.
I offered something similar here [1] and it is used by many companies including Philip Morris, and the Argentinian tax agency for the same purposes. The technique I used (I should publish it as open source) is using a Feistel cipher [2] with a key. The Feistel network could be adjusted to almost any size and the key used in every round is an expansion of a general key using a key derivation function [3] (KDF3 if I re…
If the original numeric ID can be figured out from the sqid string, then what’s the point of the conversion?
The original numeric ID(s) can only be decoded if you know the original alphabet that was used for encoding.
Side note: there are some business insights you can get from a company using serial ids. i.e if you sign up and get user id 32588 and make another account a few days later, you can tell the growth rate of the company. And this is possible with every resource type in the application. I do wonder how much the url bar junk thing matters these days. I tend to use uulids (waiting on uuid v7 wide adoption), and they're a b…
Yes but just using Sqids doesn't fix this. Sqids are decodable. You need to use a random or otherwise unpredictable input. What's the advantage of uuid7 (sequential + random) vs uuid4 (full random) for this?
If the original numeric ID can be figured out from the sqid string, then what’s the point of the conversion?
I see many people in this thread saying that this is a good way to hide insights from ids/numbers, I don't understand, aren't the generated values easily decoded? couldn't I just decode a couple of numbers to get that insight? What am I missing.
I offered something similar here [1] and it is used by many companies including Philip Morris, and the Argentinian tax agency for the same purposes. The technique I used (I should publish it as open source) is using a Feistel cipher [2] with a key. The Feistel network could be adjusted to almost any size and the key used in every round is an expansion of a general key using a key derivation function [3] (KDF3 if I re…
[0] https://bytes.grubhub.com/why-we-use-crypto-when-generating-...
Earlier quoted context omitted.
Yes but just using Sqids doesn't fix this. Sqids are decodable. You need to use a random or otherwise unpredictable input. What's the advantage of uuid7 (sequential + random) vs uuid4 (full random) for this?
You can extract the timestamp from UUID7/8 so it also can reveal business information.
Side note: there are some business insights you can get from a company using serial ids. i.e if you sign up and get user id 32588 and make another account a few days later, you can tell the growth rate of the company. And this is possible with every resource type in the application. I do wonder how much the url bar junk thing matters these days. I tend to use uulids (waiting on uuid v7 wide adoption), and they're a b…
> you can tell the growth rate of the company. You can even do this when you don’t know the exact interval by using probabilities. The Allies used this method to estimate German tank production in World War II by analyzing the serial numbers of captured or destroyed tanks. This is know as the German Tank Problem [1] [1] https://en.wikipedia.org/wiki/German_tank_problem