From: Mark Mielke <mark@mark.mielke.cc>
To: Bill Moran <wmoran@collaborativefusion.com>
Cc: Steve Atkins <steve@blighty.com>
Cc: PostgreSQL Performance <pgsql-performance@postgresql.org>
Subject: Re: Using PK value as a String
Date: Tue, 12 Aug 2008 11:56:22 -0400
Message-ID: <48A1B2A6.4060003@mark.mielke.cc> (raw)
In-Reply-To: <20080812114840.8f7468ed.wmoran@collaborativefusion.com>
References: <18986.60888.qm@web25807.mail.ukl.yahoo.com>
<48A15ECF.5030203@sime.com>
<87od3ywg4n.fsf@oxford.xeocode.com>
<0673579A-B049-4619-B6E4-EE427FB0DDBA@globalinn.com>
<1343069D-263F-4D99-BF7E-269C8F0E7F1F@houseofdesign.de>
<20080812110416.8e0d6e1c.wmoran@collaborativefusion.com>
<4D558373-E7B0-40EC-95EF-FDFE7046ABA2@houseofdesign.de>
<20080812112136.72af4bff.wmoran@collaborativefusion.com>
<233F1248-E3EA-4572-9310-4E4BC13995DE@blighty.com>
<20080812114840.8f7468ed.wmoran@collaborativefusion.com>
Bill Moran wrote:
>>>>>> We chose UUID as PK because there is still some information in an
>>>>>> integer key.
>>>>>> You can see if a user has registered before someone else
>>>>>> (user1.id <
>>>>>> user2.id)
>>>>>> or you can see how many new users registered in a specific period
>>>>>> of
>>>>>> time
>>>>>> (compare the id of the newest user to the id a week ago). This is
>>>>>> information
>>>>>> which is in some cases critical.
>> I think Moritz is more concerned about leakage of critical information,
>> rather than intentional storage of it. When a simple incrementing
>> integer
>> is used as an identifier in publicly visible places (webapps, ticketing
>> systems) then that may leak more information than intended.
>>
While we are on this distraction - UUID will sometimes encode "critical"
information such as: 1) The timestamp (allowing users to be compared),
and 2) The MAC address of the computer that generated it.
So, I wouldn't say that UUID truly protects you here unless you are sure
to use one of the UUID formats that is not timestamp or MAC address
based. The main benefit of UUID here is the increased keyspace, so
predicting sequence becomes more difficult.
(Note that an all-random UUID is not better than two pairs of all-random
64-bit integers with a good random number source. :-) )
Cheers,
mark
--
Mark Mielke <mark@mielke.cc>
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-performance@postgresql.org
Cc: mark@mark.mielke.cc, wmoran@collaborativefusion.com, steve@blighty.com
Subject: Re: Using PK value as a String
In-Reply-To: <48A1B2A6.4060003@mark.mielke.cc>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox