> Brian volunteering to host and entertain total strangers represents the importance of placing your customer front-and-center at every company stage. Brian could be "beyond that." He's not. He wants to see the details of what being a host is like so he can improve his product.
So much simping... a CEO of a small company worships at the altar of a CEO of a unicorn.
Maybe Brian should book random airbnbs next, ones that don't exist or have cockroaches as other guests. And then try calling support and getting his money back, without flashing his User ID = 3 badge...
Agreed. It would certainly be more revealing to read an article from Brian Chesky about his experience as a guest, rather than someone else's experience as his guest. At the moment this has the sort of "house swap" TLC show vibe, but only half of it. It's missing the part where the rich guy sees the poor side of the coin.
They'll have to deal with the companies like blackrock who was buying out the supply of homes and making them uninhabitable and forcing them to resell it. That would make a much greater difference than Airbnb.
To save anyone a click, the author figured that AirBnB's urls had monotonically increasing numeric ids, which is the Rails default, and figured out that the AirBnB CEO's id was 3, and got the direct link before it was shared publicly.
This article doesn’t make good on its claim to explain why this “Rails convention” is bad. It’s probably actually good. I wouldn’t have clicked on it otherwise. Rude, IMO.
Some main weaknesses, if I recall correctly, is that's incremental ids make scraping pretty easy, or guessing content outside of a URL given explicitly by the service (like here).
Yep, you're correct. Panera had an issue where folks could scrap every user profile due to sequential profile ids. The bigger part of the exploit was they just openly exposed user data but making the profiles ids sequential made it really easy to scrap
It's "good" if you're enumerating a potential target!
Otherwise, you typically either want to make your URLs intuitively discoverable or not discoverable at all. An incrementing ID like this is neither, so it sits in a weird middle ground that probably satisfies nobody (except those trying to get things done who don't care, I guess).
The incrementing itself wasn't the issue! It's all the other stuff around their scraping and apparently their provable desire to harm AT&T that got them convicted.
I believe this convention was used widely outside of Rails too so it's less a Rails convention and more a late 90s early 2000s convention. Even now I suspect many articles with good SEO will give table creation SQL using auto increment instead of uuid so maybe just software convention.
There’s no engineering analysis in this post, so those of us who were looking for that, let me save you the click
Be born to the right people and toe the party line. That’s what Brian’s story will show you. But that’s basically a cliche right now so I doubt you’re in any way surprised
"If Brian Chesky, cofounder and CEO at Airbnb, listened to his mom, Airbnb wouldn't exist today. Or at least according to her:
"I told him it's a bad idea. I didn't think it was going to work, and I didn't really understand it. If he listened to me, Airbnb wouldn't be here now.""
I mean, in the end, isn't it turning out to be a bad idea? Removing homes from the rental market, increasing housing prices. Encouraging more treatment of housing as an investment.
Even if Airbnb ceases to exist tomorrow, I am fairly certain that Brian is gonna be in a better spot than he would have been in if he listened to his mom.
Not so sure. Not trying to defend Brian or AirBnB, but realistically, it was bound to happen, just like Uber was.
Perhaps under a different name with a different path, but I am fairly certain that the ending would have been the same. And there are definitely lessons to be learned form this. And honestly, it could've been much worse, so I am ok with those lessons being learner earlier rather than later. I think they were pretty useful.
I mean, the guy has a net worth of ~$9 Billion, so, I think it's worked out pretty well for him, you know, being squarely in the tres commas club and all.
And we can say good idea/bad idea all you'd like, that's just opinion at the end of the day, the truth is there was a market for his idea, a huge one, and the market isn't mound by any sort of moral or ethical or even logical means, so applying those things in order to support a notion of 'good' or 'bad' isn't going to yield truth by any measure.
I think what you're seeing, mostly, with short term rentals, is a lack of housing inventory being created. We've got plenty of space to build, but, for a litany of reasons, it's not being built, and in a general sense, the solution to this problem is to solve those problems that're in the way of adding inventory.
AirBnB is not the cause of housing scarcity, the under building of Hotels to meet short term stay demand, or the economic conditions that facilitate a lot of travel. If it weren't for AirBnB other players in the short term rental business would likely ave moved into the same niche.
And the price is probably a really good signal of unmet housing demand, which has (probably) caused a lot more units to be built than would have otherwise.
> which has (probably) caused a lot more units to be built than would have otherwise.
You would think so, but in the US's tightest property markets its basically impossible to build new housing due to some combination of zoning, local review boards, NIMBY activists, and onerous environmental regulations (thing will this increase school demand not will it spew toxic waste).
>Removing homes from the rental market, increasing housing prices.
Wow, I didn't know this! How are housing costs going in cities that have banned or highly regulated Airbnb, like NYC or Paris? I suppose these are highly affordable cities with falling rents?
The tone in here sure has shifted. I remember Brian showing us his binder of maxed out credit cards they used to bootstrap the company. I remember the early version spitting unicorn errors every few seconds.
A few things can be true at the same time:
- Airbnb is an inspiring story for any entrepreneur
- it has had arguably detrimental impacts
- the founders came from privileged backgrounds
- they also worked their ass off and are fiercely intelligent and risked plenty
On the tech side - it’s always funny to hear the (correct) critiques of early Rails. It reminds me of when I was talking trash about Java as a kid. My boss laughed and said “Java bought me my house, so it’s good in my book”. Or the first Tesla I ever saw with the license plate “PHP LOL” in the Facebook parking lot.
Pragmatism must beat idealism. In business and in database primary keys and everything in between.
If you come from a privileged background then what are you risking really? Maxed out credit cards can easily be repaid by your rich parents/uncles/whatever.
Though perhaps there are things they risked that I am not familiar with.
Risk does not necessarily mean financial risk. There's a lot more being risked doing a startup than cash, and those things should be pretty obvious, though maybe not everyone sees them as risks. I can think of a few and I've never done a startup. Reputation, mental health, credibility, friends and business associates, future job prospects, legal risks, etc. Fuck up a startup bad enough and even if you have millions in the bank you could have lost all of the things I just listed.
Call me a dreamer but losing the things I mentioned is worse than losing money, which would be the same experience for both rich and poor people, since they have absolutely nothing to do with a number in a ledger.
It's funny there's a spate of complaints about how fees have crept up to the point that AirBnB is not longer a deal, all the municipalities that have ruled against allowing them to operate outside hotel regulations and yet they also announced a massive increase in revenue in profits.
I personally don't get this business at all. Staying in a stranger's house is even more disconcerting that renting out a house to strangers. I'm mind-boggled at home much business they get.
It's not for me either. I have rented whole units, out of need(cost), but wouldn't want a room in a house.
Still, some people love this sort of random interaction. Hostels are popular in some crowds. And I remember, when biking across Canada, a random couple in their 60s stopped me, in Northern Ontario(very rural!) and asked me if I wanted to stay the night.
Part of me wondered if their very nice roast and potatoes, would be my last meal.
But they just were bored, and wanted to talk, and were just nice folks not afraid of strangers. Good people.
So some like it random. Enjoy divergent personalities.
The business is exactly that. Ilegal hotels. Most airbnbs are flats/houses specifically for that. It allows individuals to be part of rental network without the pains of doing it proper.
I think their biggest issue now is that the renters got more greedy and airbnbs start to cost more than hotels. Which atleast around me didnt use to be the case.
Are there people who really think this is not a PR stunt? Pardon my cynicism but I call bullshit on all of this not being organized/orchestrated by publicist.
> It's wild (vulnerable, transparent, kind, generous, and humbling) for the CEO of a $60B company to welcome complete strangers into his home to host them – including cooking together and showing them the city – for a weekend.
This phrase is outright insulting in my view. Do you really think you will be in the company of a billionaire (and CEO of a PUBLIC company) without even basic vetting? Give me a break.
I did look for his airbnb listing at one point, after a previous broadcast that he was putting it up, and there was no way to book it. (I think not because it was already booked.)
Of course it is a pr stunt. I used to get angry at this when I was younger but then I realized we have hit the peak of actual growth in the real world a while back. So now everything is just spin. It's chopping the small rooms into smaller rooms and selling them. Soon it will be sell a part of your kidney marketplace. All of this happens because the world needs another major revolution and change. Till then enjoy the vulnerable, transparent CEO who enjoys art and doggies. It's similar to the linkedin CEO post who was so vulnerable and transparent that he had to cry and had tears in his eyes because he had to fire people.
I would expect every CEO to use their companies products. Even if they have no use for the product/service, their time using the product has to pay off in terms of better understanding the difficulties/challenges faced by the real users.
Sure, they could pay a study group to do that. But doing it themselves will probably let them make better decisions overall.
I completely agree with you. Too many CEOs and board members view their companies as numbers on a spreadsheet without understanding what they do in a practical sense or knowing what it's like to be a customer.
I coincidentally was exploring methods to obfuscate auto-incremented IDs to prevent information leakage. The concern arises when resources are accessed using URLs like "website.com/thing/1/children." This approach allows people to guess related URLs (e.g., replacing "1" with "2," "3," ..., N), potentially revealing unintended information or even the number of resources available.
To address these leaks, one option is to generate synthetic keys for each resource. However, this method is costly because it requires indexing the new key alongside the primary key (PK). Indexing is not without overhead, and synthetic keys are often larger, like 128 bits for UUIDs or ULIDs compared to a 64-bit numeric PK. This means that every record insertion necessitates dual indexing. Generating UUIDs can sometimes be challenging too because of reasons.
An alternative involves obfuscating the ID in such way that can be easily reversed in the server. Effective algorithms for this purpose are "squids" [1] (the second version of "hashids"), Skip32 Cypher [2] and ... more math :-p [3] [4]. Chaining both algorithms could provide an additional layer of obfuscation.
Before someone mentions this, yes, obfuscation is not encryption, so not a thorough security measure. But I think obfuscation is a practical way to prevent casual URL leaks, even though more determined attackers may attempt to reverse-engineer the IDs.
More options:
* Add a "salted hash" to the id, ex: website.com/thing/1-hash/children, "hash" could be something like SHA-256("--{id}--{salt}--"). Now the "attacker" would need to know how to generate the hash if trying the id "2". Could also be combined with ID obfuscation as mentioned bedfore. "salt" would be a single string per resource type, or even for the whole app.
* Encrypt the ID: only the server would know the password to decrypt the ID, so this would be secure as long as the password and method of encryption is not leaked.
AFAIK that's what youtube did, but the key eventually got leaked and attackers were using it to enumerate unlisted videos. They ended up switching to randomly generated ids. Unless you're dealing with billions of rows, the additional column + index is negligible, so it's better go with that approach rather than to be clever with encrypting ids
67 comments
[ 3.5 ms ] story [ 112 ms ] thread>It's (still) all about your users and customers
> Brian volunteering to host and entertain total strangers represents the importance of placing your customer front-and-center at every company stage. Brian could be "beyond that." He's not. He wants to see the details of what being a host is like so he can improve his product.
So much simping... a CEO of a small company worships at the altar of a CEO of a unicorn.
Maybe Brian should book random airbnbs next, ones that don't exist or have cockroaches as other guests. And then try calling support and getting his money back, without flashing his User ID = 3 badge...
> As a startup CEO of a company much earlier than Brian's – yet with plans to eclipse the success of Airbnb
Plans to eclipse Airbnb? Ok man, we get it. Mamba mentality, whatever.
Some main weaknesses, if I recall correctly, is that's incremental ids make scraping pretty easy, or guessing content outside of a URL given explicitly by the service (like here).
Wheres my billion dollars
https://krebsonsecurity.com/2018/04/panerabread-com-leaks-mi...
Otherwise, you typically either want to make your URLs intuitively discoverable or not discoverable at all. An incrementing ID like this is neither, so it sits in a weird middle ground that probably satisfies nobody (except those trying to get things done who don't care, I guess).
https://www.wired.com/2012/11/att-hacker-found-guilty/
Be born to the right people and toe the party line. That’s what Brian’s story will show you. But that’s basically a cliche right now so I doubt you’re in any way surprised
Sometimes, Brian, your mom is right.
Not for Brian, no.
Even if Airbnb ceases to exist tomorrow, I am fairly certain that Brian is gonna be in a better spot than he would have been in if he listened to his mom.
Perhaps under a different name with a different path, but I am fairly certain that the ending would have been the same. And there are definitely lessons to be learned form this. And honestly, it could've been much worse, so I am ok with those lessons being learner earlier rather than later. I think they were pretty useful.
And we can say good idea/bad idea all you'd like, that's just opinion at the end of the day, the truth is there was a market for his idea, a huge one, and the market isn't mound by any sort of moral or ethical or even logical means, so applying those things in order to support a notion of 'good' or 'bad' isn't going to yield truth by any measure.
I think what you're seeing, mostly, with short term rentals, is a lack of housing inventory being created. We've got plenty of space to build, but, for a litany of reasons, it's not being built, and in a general sense, the solution to this problem is to solve those problems that're in the way of adding inventory.
You would think so, but in the US's tightest property markets its basically impossible to build new housing due to some combination of zoning, local review boards, NIMBY activists, and onerous environmental regulations (thing will this increase school demand not will it spew toxic waste).
I'm sure Brian's mom is happy she was wrong and doesn't share your negative assessment.
> Removing homes from the rental market, increasing housing prices. Encouraging more treatment of housing as an investment.
This is a policy failure. We need to build more housing. Zoning, taxes, and NIMBYism are to blame.
Supply and demand curves are the law of the land. Add more supply and the problem is solved.
Wow, I didn't know this! How are housing costs going in cities that have banned or highly regulated Airbnb, like NYC or Paris? I suppose these are highly affordable cities with falling rents?
A few things can be true at the same time:
- Airbnb is an inspiring story for any entrepreneur
- it has had arguably detrimental impacts
- the founders came from privileged backgrounds
- they also worked their ass off and are fiercely intelligent and risked plenty
On the tech side - it’s always funny to hear the (correct) critiques of early Rails. It reminds me of when I was talking trash about Java as a kid. My boss laughed and said “Java bought me my house, so it’s good in my book”. Or the first Tesla I ever saw with the license plate “PHP LOL” in the Facebook parking lot.
Pragmatism must beat idealism. In business and in database primary keys and everything in between.
Though perhaps there are things they risked that I am not familiar with.
I personally don't get this business at all. Staying in a stranger's house is even more disconcerting that renting out a house to strangers. I'm mind-boggled at home much business they get.
Still, some people love this sort of random interaction. Hostels are popular in some crowds. And I remember, when biking across Canada, a random couple in their 60s stopped me, in Northern Ontario(very rural!) and asked me if I wanted to stay the night.
Part of me wondered if their very nice roast and potatoes, would be my last meal.
But they just were bored, and wanted to talk, and were just nice folks not afraid of strangers. Good people.
So some like it random. Enjoy divergent personalities.
I think their biggest issue now is that the renters got more greedy and airbnbs start to cost more than hotels. Which atleast around me didnt use to be the case.
> It's wild (vulnerable, transparent, kind, generous, and humbling) for the CEO of a $60B company to welcome complete strangers into his home to host them – including cooking together and showing them the city – for a weekend.
This phrase is outright insulting in my view. Do you really think you will be in the company of a billionaire (and CEO of a PUBLIC company) without even basic vetting? Give me a break.
Sure, they could pay a study group to do that. But doing it themselves will probably let them make better decisions overall.
To address these leaks, one option is to generate synthetic keys for each resource. However, this method is costly because it requires indexing the new key alongside the primary key (PK). Indexing is not without overhead, and synthetic keys are often larger, like 128 bits for UUIDs or ULIDs compared to a 64-bit numeric PK. This means that every record insertion necessitates dual indexing. Generating UUIDs can sometimes be challenging too because of reasons.
An alternative involves obfuscating the ID in such way that can be easily reversed in the server. Effective algorithms for this purpose are "squids" [1] (the second version of "hashids"), Skip32 Cypher [2] and ... more math :-p [3] [4]. Chaining both algorithms could provide an additional layer of obfuscation.
Before someone mentions this, yes, obfuscation is not encryption, so not a thorough security measure. But I think obfuscation is a practical way to prevent casual URL leaks, even though more determined attackers may attempt to reverse-engineer the IDs.
More options:
* Add a "salted hash" to the id, ex: website.com/thing/1-hash/children, "hash" could be something like SHA-256("--{id}--{salt}--"). Now the "attacker" would need to know how to generate the hash if trying the id "2". Could also be combined with ID obfuscation as mentioned bedfore. "salt" would be a single string per resource type, or even for the whole app.
* Encrypt the ID: only the server would know the password to decrypt the ID, so this would be secure as long as the password and method of encryption is not leaked.
--
1: https://sqids.org/
2: https://stackoverflow.com/a/4200193
3: https://github.com/c2h5oh/hide
4: https://en.wikipedia.org/wiki/Modular_multiplicative_inverse