Bad Rails conventions got me a weekend stay with the CEO of Airbnb | Hacker News Reader

Bad Rails conventions got me a weekend stay with the CEO of Airbnb

blog.josephofiowa.com

83 pointssteventey54 comments

The tone in here sure has shifted. I remember Brian showing us his binder of maxed out credit cards they used to bootstrap the company. I remember the early version spitting unicorn errors every few seconds.

A few things can be true at the same time:

- Airbnb is an inspiring story for any entrepreneur

- it has had arguably detrimental impacts

- the founders came from privileged backgrounds

- they also worked their ass off and are fiercely intelligent and risked plenty

On the tech side - it’s always funny to hear the (correct) critiques of early Rails. It reminds me of when I was talking trash about Java as a kid. My boss laughed and said “Java bought me my house, so it’s good in my book”. Or the first Tesla I ever saw with the license plate “PHP LOL” in the Facebook parking lot.

Pragmatism must beat idealism. In business and in database primary keys and everything in between.

It's just a clickbait title, article is actually positive in tone.

If you come from a privileged background then what are you risking really? Maxed out credit cards can easily be repaid by your rich parents/uncles/whatever.

Though perhaps there are things they risked that I am not familiar with.

Risk does not necessarily mean financial risk. There's a lot more being risked doing a startup than cash, and those things should be pretty obvious, though maybe not everyone sees them as risks. I can think of a few and I've never done a startup. Reputation, mental health, credibility, friends and business associates, future job prospects, legal risks, etc. Fuck up a startup bad enough and even if you have millions in the bank you could have lost all of the things I just listed.

Of all of the things you mentioned, rich people have much less risk comparatively than a poor person in the exact same situation

Call me a dreamer but losing the things I mentioned is worse than losing money, which would be the same experience for both rich and poor people, since they have absolutely nothing to do with a number in a ledger.

Or just a poor person in their daily life.

I would expect every CEO to use their companies products. Even if they have no use for the product/service, their time using the product has to pay off in terms of better understanding the difficulties/challenges faced by the real users.

Sure, they could pay a study group to do that. But doing it themselves will probably let them make better decisions overall.

I completely agree with you. Too many CEOs and board members view their companies as numbers on a spreadsheet without understanding what they do in a practical sense or knowing what it's like to be a customer.

I coincidentally was exploring methods to obfuscate auto-incremented IDs to prevent information leakage. The concern arises when resources are accessed using URLs like "website.com/thing/1/children." This approach allows people to guess related URLs (e.g., replacing "1" with "2," "3," ..., N), potentially revealing unintended information or even the number of resources available.

To address these leaks, one option is to generate synthetic keys for each resource. However, this method is costly because it requires indexing the new key alongside the primary key (PK). Indexing is not without overhead, and synthetic keys are often larger, like 128 bits for UUIDs or ULIDs compared to a 64-bit numeric PK. This means that every record insertion necessitates dual indexing. Generating UUIDs can sometimes be challenging too because of reasons.

An alternative involves obfuscating the ID in such way that can be easily reversed in the server. Effective algorithms for this purpose are "squids" [1] (the second version of "hashids"), Skip32 Cypher [2] and ... more math :-p [3] [4]. Chaining both algorithms could provide an additional layer of obfuscation.

Before someone mentions this, yes, obfuscation is not encryption, so not a thorough security measure. But I think obfuscation is a practical way to prevent casual URL leaks, even though more determined attackers may attempt to reverse-engineer the IDs.

More options:

* Add a "salted hash" to the id, ex: website.com/thing/1-hash/children, "hash" could be something like SHA-256("--{id}--{salt}--"). Now the "attacker" would need to know how to generate the hash if trying the id "2". Could also be combined with ID obfuscation as mentioned bedfore. "salt" would be a single string per resource type, or even for the whole app.

* Encrypt the ID: only the server would know the password to decrypt the ID, so this would be secure as long as the password and method of encryption is not leaked.

1: https://sqids.org/

2: https://stackoverflow.com/a/4200193

3: https://github.com/c2h5oh/hide

4: https://en.wikipedia.org/wiki/Modular_multiplicative_inverse

AFAIK that's what youtube did, but the key eventually got leaked and attackers were using it to enumerate unlisted videos. They ended up switching to randomly generated ids. Unless you're dealing with billions of rows, the additional column + index is negligible, so it's better go with that approach rather than to be clever with encrypting ids

Are there people who really think this is not a PR stunt? Pardon my cynicism but I call bullshit on all of this not being organized/orchestrated by publicist.

> It's wild (vulnerable, transparent, kind, generous, and humbling) for the CEO of a $60B company to welcome complete strangers into his home to host them – including cooking together and showing them the city – for a weekend.

This phrase is outright insulting in my view. Do you really think you will be in the company of a billionaire (and CEO of a PUBLIC company) without even basic vetting? Give me a break.

Of course it is a pr stunt. I used to get angry at this when I was younger but then I realized we have hit the peak of actual growth in the real world a while back. So now everything is just spin. It's chopping the small rooms into smaller rooms and selling them. Soon it will be sell a part of your kidney marketplace. All of this happens because the world needs another major revolution and change. Till then enjoy the vulnerable, transparent CEO who enjoys art and doggies. It's similar to the linkedin CEO post who was so vulnerable and transparent that he had to cry and had tears in his eyes because he had to fire people.

And out of sheer coincidence, one of the guests is from the small founders club world. Small world indeed.

I did look for his airbnb listing at one point, after a previous broadcast that he was putting it up, and there was no way to book it. (I think not because it was already booked.)

This article doesn’t make good on its claim to explain why this “Rails convention” is bad. It’s probably actually good. I wouldn’t have clicked on it otherwise. Rude, IMO.

It's pretty common outside of rails too, like https://facebook.com/4

Some main weaknesses, if I recall correctly, is that's incremental ids make scraping pretty easy, or guessing content outside of a URL given explicitly by the service (like here).

They also leak metrics (#of registered users)

ALTER SEQUENCE "seq_user_id" RESTART WITH 5000000000

Wheres my billion dollars

I think this is the only downside.

Yep, you're correct. Panera had an issue where folks could scrap every user profile due to sequential profile ids. The bigger part of the exploit was they just openly exposed user data but making the profiles ids sequential made it really easy to scrap

https://krebsonsecurity.com/2018/04/panerabread-com-leaks-mi...

Also, competitors can analyze your growth more easily.

It's "good" if you're enumerating a potential target!

Otherwise, you typically either want to make your URLs intuitively discoverable or not discoverable at all. An incrementing ID like this is neither, so it sits in a weird middle ground that probably satisfies nobody (except those trying to get things done who don't care, I guess).

Incrementing a URL can (and has) get you prison time.

https://www.wired.com/2012/11/att-hacker-found-guilty/

The incrementing itself wasn't the issue! It's all the other stuff around their scraping and apparently their provable desire to harm AT&T that got them convicted.

Definitely not going to argue with you on that. But it did all start with the simple addition to the URL.

Odd they didn't use his handle. I figured it was weev but never knew his real name.

In the same way that squeezing on a hunk of metal that some may call a "trigger" can get you convicted for murder.

I believe this convention was used widely outside of Rails too so it's less a Rails convention and more a late 90s early 2000s convention. Even now I suspect many articles with good SEO will give table creation SQL using auto increment instead of uuid so maybe just software convention.

There’s no engineering analysis in this post, so those of us who were looking for that, let me save you the click

Be born to the right people and toe the party line. That’s what Brian’s story will show you. But that’s basically a cliche right now so I doubt you’re in any way surprised

How much was his cleaning fee? I imagine Airbnb employees are very different hosts from the average one.

It's funny there's a spate of complaints about how fees have crept up to the point that AirBnB is not longer a deal, all the municipalities that have ruled against allowing them to operate outside hotel regulations and yet they also announced a massive increase in revenue in profits.

I personally don't get this business at all. Staying in a stranger's house is even more disconcerting that renting out a house to strangers. I'm mind-boggled at home much business they get.

It's not for me either. I have rented whole units, out of need(cost), but wouldn't want a room in a house.

Still, some people love this sort of random interaction. Hostels are popular in some crowds. And I remember, when biking across Canada, a random couple in their 60s stopped me, in Northern Ontario(very rural!) and asked me if I wanted to stay the night.

Part of me wondered if their very nice roast and potatoes, would be my last meal.

But they just were bored, and wanted to talk, and were just nice folks not afraid of strangers. Good people.

So some like it random. Enjoy divergent personalities.

The business is exactly that. Ilegal hotels. Most airbnbs are flats/houses specifically for that. It allows individuals to be part of rental network without the pains of doing it proper.

I think their biggest issue now is that the renters got more greedy and airbnbs start to cost more than hotels. Which atleast around me didnt use to be the case.

To save anyone a click, the author figured that AirBnB's urls had monotonically increasing numeric ids, which is the Rails default, and figured out that the AirBnB CEO's id was 3, and got the direct link before it was shared publicly.

Obviously I didn't RTFA, but without this comment I wouldn't had understood what that title was about. Thanks. (English is funny)

I'll be damned, billionaires are normal people! (or at least they want us to believe it)

this makes me bullish on roboflow (more than I already was)

"If Brian Chesky, cofounder and CEO at Airbnb, listened to his mom, Airbnb wouldn't exist today. Or at least according to her:

    "I told him it's a bad idea. I didn't think it was going to work, and I didn't really understand it. If he listened to me, Airbnb wouldn't be here now.""

I mean, in the end, isn't it turning out to be a bad idea? Removing homes from the rental market, increasing housing prices. Encouraging more treatment of housing as an investment.

Sometimes, Brian, your mom is right.

AirBnB is not the cause of housing scarcity, the under building of Hotels to meet short term stay demand, or the economic conditions that facilitate a lot of travel. If it weren't for AirBnB other players in the short term rental business would likely ave moved into the same niche.

And the price is probably a really good signal of unmet housing demand, which has (probably) caused a lot more units to be built than would have otherwise.

> which has (probably) caused a lot more units to be built than would have otherwise.

You would think so, but in the US's tightest property markets its basically impossible to build new housing due to some combination of zoning, local review boards, NIMBY activists, and onerous environmental regulations (thing will this increase school demand not will it spew toxic waste).

> isn't it turning out to be a bad idea?

Not for Brian, no.

Even if Airbnb ceases to exist tomorrow, I am fairly certain that Brian is gonna be in a better spot than he would have been in if he listened to his mom.

Oh yeah he will be of course. It's the rest of the world that won't be.

Not so sure. Not trying to defend Brian or AirBnB, but realistically, it was bound to happen, just like Uber was.

Perhaps under a different name with a different path, but I am fairly certain that the ending would have been the same. And there are definitely lessons to be learned form this. And honestly, it could've been much worse, so I am ok with those lessons being learner earlier rather than later. I think they were pretty useful.

> Sometimes, Brian, your mom is right.

I'm sure Brian's mom is happy she was wrong and doesn't share your negative assessment.

> Removing homes from the rental market, increasing housing prices. Encouraging more treatment of housing as an investment.

This is a policy failure. We need to build more housing. Zoning, taxes, and NIMBYism are to blame.

Supply and demand curves are the law of the land. Add more supply and the problem is solved.

>Removing homes from the rental market, increasing housing prices.

Wow, I didn't know this! How are housing costs going in cities that have banned or highly regulated Airbnb, like NYC or Paris? I suppose these are highly affordable cities with falling rents?

I mean, the guy has a net worth of ~$9 Billion, so, I think it's worked out pretty well for him, you know, being squarely in the tres commas club and all.

And we can say good idea/bad idea all you'd like, that's just opinion at the end of the day, the truth is there was a market for his idea, a huge one, and the market isn't mound by any sort of moral or ethical or even logical means, so applying those things in order to support a notion of 'good' or 'bad' isn't going to yield truth by any measure.

I think what you're seeing, mostly, with short term rentals, is a lack of housing inventory being created. We've got plenty of space to build, but, for a litany of reasons, it's not being built, and in a general sense, the solution to this problem is to solve those problems that're in the way of adding inventory.

Reply on news.ycombinator.com