uuid

> Duplicate UUIDs (Googlebot) > This module may generate duplicate UUIDs when run in clients with deterministic random number generators, such as Googlebot crawlers. This can cause problems for apps that expect client-generated UUIDs to always be unique. Developers should be prepared for this and have a strategy for dealing with possible collisions, such as: > - Check for duplicate UUIDs, fail gracefully > - Disable write operations for Googlebot clients https://github.com/uuidjs/uuid/commit/91805f665c38b691ac2cbd...

Googlebot's lack of randomness was the conclusion of a previous incident for that package https://github.com/uuidjs/uuid/issues/546

(copied from the other thread) Changed 3 weeks ago: uuid/src/rng.ts : the random array is const. Every call will share the same random number. Subsequent call will update your old random code, so if you generated something important... good luck The old code used to do a slice() which creates a new copy. https://github.com/uuidjs/uuid/blob/e1f42a354593093ba0479f0b... became https://github.com/uuidjs/uuid/blob/f2c235f93059325fa43e1106... Welp.. time to patch and update everything again. Another day, another npm-package headache. Very odd() Attack vector: call the rng(), and send the result somewhere. You now have now overwritten someone else's "random number" and know about it. The fun things you can do with those numbers!

https://github.com/uuidjs/uuid/blob/e1f42a354593093ba0479f0b... became https://github.com/uuidjs/uuid/blob/f2c235f93059325fa43e1106... Welp.. time to patch and update everything again. Another day, another npm-package headache. Very odd() Attack vector: call the rng(), and send the result somewhere. You now have now overwritten someone elses "random number" and know about it. The fun things you can do with those numbers!

Some discussion here: https://github.com/uuidjs/uuid/issues/546 Eg: > FWIW, I just tested crypto.getRandomValues() behavior on googlebot and it is also deterministic(!)

A couple resources with rigorous examination of UUIDs and the tradeoffs involved with using them: - https://www.2ndquadrant.com/en/blog/sequential-uuid-generato... - https://github.com/uuidjs/uuid/issues/303 (also mentioned: https://gist.github.com/1ma/c837e6f30c0869cfc1222f67ac8b1c52) I personally use v1 UUIDs as my main identifier and just take the performance hit. ksuids look interesting but don't think there's any need to use that when v1 uuids are good enough.