Live data from Hacker News

Ask HN: We just had an actual UUID v4 collision...

news.ycombinator.com

71–80 of 369 posts

Re: Ask HN: We just had an actual UUID v4 collision...

#71
This is why I prefer to use a random base32 string over UUID. At least you get a proper 128 bit entropy instead of just a 122 bit entropy as with UUIDv4. That's a 64x difference in collision probability. I always thought UUIDs were a toy, not for serious use. If you control the strings, you can even make a longer ID.

Also, numerous applications that use a unique ID per record frequently need to check for ID collisions. I know I do for a short URL generator.

Re: Ask HN: We just had an actual UUID v4 collision...

#72
post #3

1 in 4.72 × 10²⁸ 1 in 47.3 octillion. i'd be suspecting a race condition or some other naive mistake, otherwise id be stocking up on lottery tickets. (lol at the other user posting at the same time about the lottery ticket.. great minds and all that.)

The lottery ticket part makes no sense. Statistically if such an improbable event just happened to him, then chance of it happening again should be even more improbable.

Re: Ask HN: We just had an actual UUID v4 collision...

#73

Funny story no one will believe, but it’s true. A good friend of mine joined a startup as CTO 10 years ago, high growth phase, maybe 200 devs… In his first week he discovered the company had a microservice for generating new UUIDs. One endpoint with its own dedicated team of 3 engineers …including a database guy (the plot thickens). Other teams were instructed to call this service every time they needed a new ‘safe’…

Pffft - they didn't need to store the whole UUID, just a hash. Dummies.

Re: Ask HN: We just had an actual UUID v4 collision...

#74

Earlier quoted context omitted.

You let users generate a UUID? To be honest, the chance that you are doing something weird is probably higher than you experiencing a real UUID conflict. How did your database 'flag' that conflict?

If it's UUIDv4 and you validate that the UUID is valid and not conflicting I don't really see the issue with user-generated UUIDs. Being able to generate unique keys in an uncoordinated manner is the main selling point of UUIDs Sure, it's something I'd flag in any design to spend two minutes to talk about potential security implications. But usually there aren't any

Validation etc. every thing which should not be controlled by a user, will not be controlled by a user.

Re: Ask HN: We just had an actual UUID v4 collision...

#76
post #73

Funny story no one will believe, but it’s true. A good friend of mine joined a startup as CTO 10 years ago, high growth phase, maybe 200 devs… In his first week he discovered the company had a microservice for generating new UUIDs. One endpoint with its own dedicated team of 3 engineers …including a database guy (the plot thickens). Other teams were instructed to call this service every time they needed a new ‘safe’…

Pffft - they didn't need to store the whole UUID, just a hash. Dummies.

They thought of that, but they were still working on hiring a team to maintain the hashing microservice.

Re: Ask HN: We just had an actual UUID v4 collision...

#77
Something off on how the RNG is initialized? Lack of entropy?

If the rng is not customized it will use:

    const rnds8 = new Uint8Array(16);
    export default function rng() {
        return crypto.getRandomValues(rnds8);
    }
getRandomValues doesn't specify a minimum amount of entropy.

Re: Ask HN: We just had an actual UUID v4 collision...

#78
post #77

Something off on how the RNG is initialized? Lack of entropy? If the rng is not customized it will use: const rnds8 = new Uint8Array(16); export default function rng() { return crypto.getRandomValues(rnds8); } getRandomValues doesn't specify a minimum amount of entropy.

It's a near certainty that something is badly wrong with the RNG, and, yes, probably in how it's seeded.

It's probably messing up the cryptography, too.

Re: Ask HN: We just had an actual UUID v4 collision...

#79

What you're talking about is so extremely rare that it's much more likely that the entire Earth is destroyed by an asteroid right this inst...

Well it would be statistically even rarer for that UUID collision to happen and the earth to be destroyed by an asteroid.

Re: Ask HN: We just had an actual UUID v4 collision...

#80

> I thought this is technically impossible Actually it's not impossible, but very very improbable. P.S. You should play a lottery/powerball ticket P.P.S. Whenever I use the word improbable, the https://hitchhikers.fandom.com/wiki/Infinite_Improbability_D... comes in mind

> P.S. You should play a lottery/powerball ticket

Actually, they should not. That collision and winning the lottery would be even rarer.

Post reply on HN