1
69%
master: 97%

Ran 23 Oct 2015 11:37AM UTC

Files 87

Run time 12s

Badge

Embed ▾

Committed 23 Oct 2015 11:29AM UTC coverage: 68.71%. Remained the same

Job # 8770.1

Build Type

push

travis-ci

Committed by

nickstenning

Commit Message

Replace all uses of Group.hashid with Group.pubid

This commit removes all use of the Group.hashid property, and then
removes all the supporting infrastructure for hashids.

For posterity, it's worth noting the reason for this change: at the time
of writing, we are using hashids for two reasons:

1. To prevent users from guessing the URL for the "join a group" pages
   of groups they have not been invited to.

2. To avoid leaking details of the how many groups have been created
   through the use of an integer primary key in URLs.

Both of these are ultimately security requirements, and the
cryptographic properties of hashids are questionable at best:

    https://carnage.github.io/2015/08/cryptanalysis-of-hashids/

In order to avoid the possibility of having to remove hashids at a later
date, thus breaking many URLs, we are adopting a much simpler, much more
"stupid" (i.e. less "clever"), way of generating this "public IDs",
which now relies for its cryptographic properties on the system
CSPRNG[^1] rather than the algorithm or implementation of hashids. And,
frankly, if /dev/urandom is broken, we have bigger problems...

[^1]: "Cryptographically Secure Pseudo-Random Number Generator". See
      also: https://en.wikipedia.org/wiki/Cryptographically_secure_pseudorandom_number_generator

Run Details

2499 of 3637 relevant lines covered (68.71%)

0.69 hits per line

hypothesis / h / 8770 / 1
69%
master: 97%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Source Files on job 8770.1

hypothesis / h / 8770 / 1 69% master: 97%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Source Files on job 8770.1

hypothesis / h / 8770 / 1
69%
master: 97%

README BADGES
x