nanoid VS cuid2

Last thing left is to use our new upload function in our server action. Since I like to upload images in single format and have some more control over them, I will additionally use sharp library. For file name, I'll generate some random string using nanoid:

Our API is in node. And God, how I suffered to import nanoid in an esmodule project. I had to vendor it, since using a previous version was not ideal. With bun, we can no longer worry about that. Just import what you need and done.

No thread about UUID is complete without a plug for NanoID! https://github.com/ai/nanoid/blob/main/README.md

Generate a unique file name using the nanoid library.

The syntax should read similar to SQL itself. We’re using a Python port of nanoid to generate our IDs. There’s only one thing missing… how do we actually create the table?

I usually go for Nano Id for new projects https://github.com/ai/nanoid

Nano ID

In another comment I mentioned I use nanoid in my projects now. It has a default space of 64^21 and has an a page where you can play with key lengths and alphabet sizes and see the probability of collisions :

https://zelark.github.io/nano-id-cc/

At the default 64 character alphabet with a 21 character key length it would take ~41 million years in order to have a 1% probability of at least one collision if you generated 1000 ids per second.

Using randomly generated IDs like Nano ID could be a good alternative, however, as a developer, we must understand what Nano ID really does in our application. Defining the number of characters in the generated IDs is also important, to help with that Nano ID has a Collision Calculator to give us how many years in order to have a 1% probability of collision.

The CUID readme [1] explains that there's no real point to K-sortable on modern hardware:

[1] https://github.com/paralleldrive/cuid2?tab=readme-ov-file#no...

There's a comparison in the README of the project:

https://github.com/paralleldrive/cuid2#the-contenders

Some of the arguments mentioned are explained elsewhere in the README, others are assumed.

One argument standing out for me is the lack of collision-resistance for UUIDv4 which is surprising for me and I didn't spot any sources for that argument.

Another argument is the entropy source where they go about that Math.random is not reliable as a single entropy source but glimpsing at the source code, they sprinkle the CUID with Math.random data.

I am no expert in ID security, so I am not qualified to speak about the validity of their arguments, only that there's insufficient information to validate without prior knowledge about the problem domain.

I'm recently finding cuid2 to be the best of these alternative GUIDs. They seem to have all of the benefits for what you would want to use a GUID for, but none of the drawbacks of existing implementations.[1]

[1]: https://github.com/paralleldrive/cuid2#the-contenders

I've just released v2.0.0 of my cuid2 python port. The original cuid2 package comes from JS world by ParallelDrive. They have a lot of the reasons to use Cuid2 posted in their repo, including

I recently wrote a Go implementation of CUID2 because I could not find an existing one. It is not hello-world, but it is not duff's device either, which by the way neither could explain what it did from just the raw code in isolation.

I think this implementation is the original one. It has the following to say about why it exists. And what it is good for:

There's also https://github.com/paralleldrive/cuid2 which likely should be added to this as it is likely one of the better ones out there now.

If you're using prisma then you can use CUID or CUID2 to manually generate it.