51–60 of 68 posts
The tone in here sure has shifted. I remember Brian showing us his binder of maxed out credit cards they used to bootstrap the company. I remember the early version spitting unicorn errors every few seconds. A few things can be true at the same time: - Airbnb is an inspiring story for any entrepreneur - it has had arguably detrimental impacts - the founders came from privileged backgrounds - they also worked their as…
How much was his cleaning fee? I imagine Airbnb employees are very different hosts from the average one.
I personally don't get this business at all. Staying in a stranger's house is even more disconcerting that renting out a house to strangers. I'm mind-boggled at home much business they get.
Are there people who really think this is not a PR stunt? Pardon my cynicism but I call bullshit on all of this not being organized/orchestrated by publicist. > It's wild (vulnerable, transparent, kind, generous, and humbling) for the CEO of a $60B company to welcome complete strangers into his home to host them – including cooking together and showing them the city – for a weekend. This phrase is outright insulting…
To address these leaks, one option is to generate synthetic keys for each resource. However, this method is costly because it requires indexing the new key alongside the primary key (PK). Indexing is not without overhead, and synthetic keys are often larger, like 128 bits for UUIDs or ULIDs compared to a 64-bit numeric PK. This means that every record insertion necessitates dual indexing. Generating UUIDs can sometimes be challenging too because of reasons.
An alternative involves obfuscating the ID in such way that can be easily reversed in the server. Effective algorithms for this purpose are "squids" [1] (the second version of "hashids"), Skip32 Cypher [2] and ... more math :-p [3] [4]. Chaining both algorithms could provide an additional layer of obfuscation.
Before someone mentions this, yes, obfuscation is not encryption, so not a thorough security measure. But I think obfuscation is a practical way to prevent casual URL leaks, even though more determined attackers may attempt to reverse-engineer the IDs.
More options:
* Add a "salted hash" to the id, ex: website.com/thing/1-hash/children, "hash" could be something like SHA-256("--{id}--{salt}--"). Now the "attacker" would need to know how to generate the hash if trying the id "2". Could also be combined with ID obfuscation as mentioned bedfore. "salt" would be a single string per resource type, or even for the whole app.
* Encrypt the ID: only the server would know the password to decrypt the ID, so this would be secure as long as the password and method of encryption is not leaked.
--
2: https://stackoverflow.com/a/4200193
3: https://github.com/c2h5oh/hide
4: https://en.wikipedia.org/wiki/Modular_multiplicative_inverse
The tone in here sure has shifted. I remember Brian showing us his binder of maxed out credit cards they used to bootstrap the company. I remember the early version spitting unicorn errors every few seconds. A few things can be true at the same time: - Airbnb is an inspiring story for any entrepreneur - it has had arguably detrimental impacts - the founders came from privileged backgrounds - they also worked their as…
If you come from a privileged background then what are you risking really? Maxed out credit cards can easily be repaid by your rich parents/uncles/whatever. Though perhaps there are things they risked that I am not familiar with.
Earlier quoted context omitted.
AirBnB is not the cause of housing scarcity, the under building of Hotels to meet short term stay demand, or the economic conditions that facilitate a lot of travel. If it weren't for AirBnB other players in the short term rental business would likely ave moved into the same niche.
And the price is probably a really good signal of unmet housing demand, which has (probably) caused a lot more units to be built than would have otherwise.
You would think so, but in the US's tightest property markets its basically impossible to build new housing due to some combination of zoning, local review boards, NIMBY activists, and onerous environmental regulations (thing will this increase school demand not will it spew toxic waste).
Earlier quoted context omitted.
It's pretty common outside of rails too, like https://facebook.com/4 Some main weaknesses, if I recall correctly, is that's incremental ids make scraping pretty easy, or guessing content outside of a URL given explicitly by the service (like here).
They also leak metrics (#of registered users)
Wheres my billion dollars
Earlier quoted context omitted.
Incrementing a URL can (and has) get you prison time. https://www.wired.com/2012/11/att-hacker-found-guilty/
The incrementing itself wasn't the issue! It's all the other stuff around their scraping and apparently their provable desire to harm AT&T that got them convicted.
I coincidentally was exploring methods to obfuscate auto-incremented IDs to prevent information leakage. The concern arises when resources are accessed using URLs like "website.com/thing/1/children." This approach allows people to guess related URLs (e.g., replacing "1" with "2," "3," ..., N), potentially revealing unintended information or even the number of resources available. To address these leaks, one option is…
Earlier quoted context omitted.
> isn't it turning out to be a bad idea? Not for Brian, no. Even if Airbnb ceases to exist tomorrow, I am fairly certain that Brian is gonna be in a better spot than he would have been in if he listened to his mom.
Oh yeah he will be of course. It's the rest of the world that won't be.
Perhaps under a different name with a different path, but I am fairly certain that the ending would have been the same. And there are definitely lessons to be learned form this. And honestly, it could've been much worse, so I am ok with those lessons being learner earlier rather than later. I think they were pretty useful.