Live data from Hacker News

PostgreSQL and UUID as Primary Key

maciejwalkowiak.com

341–345 of 345 posts

Re: PostgreSQL and UUID as Primary Key

#341

Earlier quoted context omitted.

I read your post and hear echoes of "Who would ever need more than 2 digits for the year in this timestamp column?" Never again.

Using 2 digits for year is as wrong as using 8 bytes for year.

Don't wake me up when year 9,223,372,036,854,775,807 rolls by please.

Re: PostgreSQL and UUID as Primary Key

#342

Earlier quoted context omitted.

They are not theoretically guaranteed they are in practice though. 2^128 and 122 are big numbers. Even if you are producing a billion per second you have a 50% chance of not getting a collision for 100 years.

I've used 128 secure-random bits for ages, not caring for any of the UUID version nonsense. Per the birthday paradox, I need to have 2*64 entries in my tables to reach 50% collision probability, and it will be a while before I can afford that much storage anyhow.

Should have been 2*64.

Re: PostgreSQL and UUID as Primary Key

#343

Earlier quoted context omitted.

How about secure by default?

“Secure” is only meaningful against a defined threat model. Most threat models for database IDs do not require their creation timestamp to be secret. Meanwhile every use case for database IDs requires them to be looked up in an index.

I've run multiple info-exfiltrating attacks based on timestamps and sequential identifiers against various actors. There you have your threat model. While I don't have any clue about your "most", I suggest you don't ignore this vector for your opsec.

Re: PostgreSQL and UUID as Primary Key

#344

Earlier quoted context omitted.

Oh no, someone might know the number of customers, or the rate of signups. Traditional businesses can figure this out by sitting in the parking lot. Why SaaS has decided it’s a huge problem is beyond me.

i mean, you might care if the investors you’re trying to woo for that bridge round figure out your churn is a lot higher than you’re willing to admit… or worse, your traction is terrible.

So I should introduce complexity in my application so in the future it might help me dupe potential investors if my startup is not going well? That’s a whole new take on pre-mature optimization. I’d rather not dupe investors, and would rather not introduce unnecessary complexity, instead I’d rather focus on actually delivering value so investors actually want to invest.
Post reply on HN