From: Greg Stark <gsstark@mit.edu>
To: josh@agliodbs.com
Cc: mark@mark.mielke.cc, pgsql-sql@postgresql.org, nathan wagner <nw@hydaspes.if.org>
Subject: Re: uuid type (moved from HACKERS)
Date: 07 Sep 2005 21:13:01 -0400
Message-ID: <877jds5plu.fsf@stark.xeocode.com> (raw)
In-Reply-To: <200509071335.56822.josh@agliodbs.com>
References: <20050906135057.GA24136@granicus.if.org>
<200509071131.17161.josh@agliodbs.com>
<20050907201016.GA24672@mark.mielke.cc>
<200509071335.56822.josh@agliodbs.com>
Josh Berkus <josh@agliodbs.com> writes:
> Mark, Nathan,
>
> I'm moving this over to the PGSQL-SQL list, away from -hackers, as it's no
> longer a -hackers type discussion. Hope you don't mind!
>
> > On Wed, Sep 07, 2005 at 11:31:16AM -0700, Josh Berkus wrote:
> > > I'm also a little baffled to come up with any real application where
> > > making an id number for most tables "unguessable" would provide any
> > > kind of real protection not far better provided by other means. For
> > > your "users" table, sure, but that's a very special case.
> >
> > It should never be the sole means of defense, however, it can be quite
> > effective at prevention.
> >
> > For a rather simple example, consider a site that associates a picture
> > with each member. If the pictures are named 1.jpg, 2.jpg, 3.jpg, etc.
> > it makes it ridiculously easy to write a script to pull all of the
> > pictures off the site. This can be bothersome, as the only type of
> > person who would do this, is the type of person with an illegitimate
> > motivation. I want the data to be easily and freely accessible as
> > specific objects, but I do not wish to provide an easy way of
> > dumping all of the data as a unit.
Of course you could have just done the same thing using an hmac (or a simple
hash like crypt) and not had to store an extraneous meaningless piece of
information in your database.
--
greg
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-sql@postgresql.org
Cc: gsstark@mit.edu, josh@agliodbs.com, nw@hydaspes.if.org
Subject: Re: uuid type (moved from HACKERS)
In-Reply-To: <877jds5plu.fsf@stark.xeocode.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox