@01189998819991197253 @ConstantPain

Security isn't binary, it's a spectrum. You apply the level of security that is appropriate for each situation.

Of course it's *possible* to brute force it, but by the same logic you could brute force jwt tokens, or api keys, or even ssl certs.

It's literally *impossible* to apply "max security" to everything, so you have to prioritize.

What happened was unconscionable, but insisting uuid are mathematically breakable isn't helpful, and can make it worse.