Hacker News Reader

HNHacker News

Top New Best Ask Show Jobs

Comment by danuker | Hacker News Reader

Parent Full thread

danuker·

> why go through all the trouble of reinventing the wheel?

Because now you depend on an UUID library and its attack surface.

In some environments it is crucial to reduce dependencies.

View on HN

You can generate the UUID in the database. And UUID generation is something that you can also find in the standard library quite often, in both those cases you don't need to add an additional dependency.

Yeah, UUID generation should be from the DB. Have a stored procedure for putting creating the record and return the UUID from that, rather than it being provided from outside.

UUID is part of your language stdlib, or at least there will be widely tested dependencies for the formats. Are you that certain about the parser of your own custom format?...

>Because now you depend on an UUID library and its attack surface.

I can appreciate reducing dependencies, but this is bordering on paranoia.

Whenever there's a "parse" method (as shown in this article), there's the possibility of poor implementation and exploitability.

Sorry, I do not get your point. If your inputs come from outside your system, you have to sanitize them, period. It would be the same thing for the original poster of this thread if the ids are being generated client-side. Besides, you're also running the risk of poor implementation for an ad-hoc system, which in my opinion is order of magnitudes larger than using a battle tested algorithm.

Reply on news.ycombinator.com