

You can help by donating to Ukrainian's army. We are uniting against Putin’s invasion and violence, in support of the people in Ukraine. Russians ruthlessly kill all civilians in Ukraine including childs and destroy their cities. But most of the time, using UUID as the primary key is a sign of pre-mature optimization and it's also a choice hard to revert afterward.Today, 3rd May 2023, Ukraine is still bravely fighting for democratic values, human rights and peace in whole world. There are valid cases of choosing UUID e.g. And most applications are less complex than those issue tracking tools. Jira, Apple's Radar, Google's issue tracker, etc. In fact, all major issue tracking systems use an integer as the issue id. and issue id such as issue/123 is definitely more readable than issue/b1e92c3b-a44a-4856-9fe3-925444ac4c23. The tool likely will have at most 5 figure projects each containing 5 figure issues. Take the classic issue tracking/project management tool as an example. order #), inspected by the operation engineer, customer support etc.ĩ9.9% of the applications won't reach internet scale and they just consist of several models allowing CRUD operations, containing thousands of records.

The primary key is not only used by the system, it's also exposed to the end user (e.g. Numbers are easy to write, easy to remember and easy to communicate.

Why? Readability, and readability leads to simplicity. 95% of the time, the default choice should always be Auto Increment Integer. Attackers can also scan the integer range to explore leakage (though it shouldn't happen if ACL is implemented correctly).Īs listed above, there are Pros and Cons between the 2 approaches.

People design their own UUID format to fix this and there is also a draft proposal to standardize it. Though v1 UUID format contains the timestamp, it encodes the timestamp using little-endian in that the least significant time appears first, which renders the UUID hard to sort according to creation time. Not naturally sortable according to creation time.Version 1 UUID stores timestamp info, which could be useful sometimes.However, your security team would always insist that a publicly accessible UUID path does not meet the security standard. A sense of security since the malicious users can't guess the ID.Stateless, it can be generated on the fly.Easy for migrating data between systems since collision is only theoretically possible. No false positive for finding items using log. Most of the time, people either choose v4 (random UUID) or v1 (timestamp UUID) There are 5 standard UUID formats nowadays. By referring to some articles, I got the information below: UUID
