Re:Show HN: Hoist – Zapier for Developers (scripting done in...
by nikolay on Monday October 12, 2015 @05:36PM
(#10377086)
Why do you autopick user slug to be "<first-name><last-name><user-id>"?!
[ Parent
| on HN ]
Re:Show HN: Hoist – Zapier for Developers (scripting done in...
by buildmaster on Monday October 12, 2015 @05:49PM
(#10377146)
it's not user id but actually just a random number. it's unrelated to your ID (which are actually more complex than just integers). The random number is there just to ensure we don't get collisions on slugs.
Re:Show HN: Hoist – Zapier for Developers (scripting done in...
by nikolay on Monday October 12, 2015 @07:18PM
(#10377444)
This is a pretty bad practice. You should use hashids [0] for this, instead!
Re:Show HN: Hoist – Zapier for Developers (scripting done in...
by buildmaster on Monday October 12, 2015 @08:59PM
(#10377835)
I should also add that we don't use the URL for any kind of security/lookup. we rely on other information for that. as such the aim is to give readable canonical urls to your application, much like most apps use a /{username} slug
Re:Show HN: Hoist – Zapier for Developers (scripting done in...
by buildmaster on Monday October 12, 2015 @08:57PM
(#10377829)
thanks for the link, I agree it's bad practice if there's any kind of lookup/security based on the slug. We have a few other mitigations against looking up anything security wise from the slug itself. but will take it into consideration as I agree it increases guess-ability of the slugs and could leave us open in future.
Re:Show HN: Hoist – Zapier for Developers (scripting done in...
by nikolay on Wednesday October 14, 2015 @02:59PM
(#10388617)
It's just an eyesore. If I see some random ID, I won't be bothered, but to see my name with some suffix to it - it's ugly and not a common practice anyway. There are better ways to generate unique IDs and hashids make them pretty short as well (shorter than their numerical counterparts, I mean).