{"by":"wooby","id":788884,"kids":[788969],"parent":788413,"text":"Hi, looks like it was a fun project. While you save yourself from checking the DB for a duplicate hash with your hex id strategy, a side effect of this technique is that every URL created with your service is effectively public. For instance, I could start at <a href=\"http://briancray.com/tests/shorturl/0\" rel=\"nofollow\">http://briancray.com/tests/shorturl/0</a> and work my way up through every URL ever shortened by incrementing the id in hex. Whether this is a vulnerability or undocumented feature is up to you to decide :)<p>I bring it up because I ran across the same issue with my own site, droplink.me. It was a more serious problem for me, because user uploaded files are supposed to be private. I went with randomly generated URLs.","time":1251362529,"type":"comment"}