Until you have any reason to believe UUIDs (and not bugs or misunderstanding as the blog post) are the critical component in the system, just use them. Look at the odds for collision with a proper setup (ntp + any modern cpus) then look at odds for anything else being an issue.
The math is simply not in there favor, by a number so large we cannot conceive of it in our tiny brains.
UUIDs have other useful properties. For example, they don't expose counts (e.g. how many customers you have.) They make URL / resource guessing impossible.
ids in the form of `[prefix]_[uuid stripped of dashes]` is ideal for most use cases. It should be the default the way Postgres is the default. Any deviation have good reason.
> Ultimately, we'd have to design the system to handle collision anyway.
It's possible for a bug to create a collision. But it's also possible for a bug to return someone else's ID at any point in the process. So even if you try to "handle" collisions, it might not work. You can't programmatically detect a mistake like that. Detection only works for bugs in a narrow slice of the pipeline. And extra complication in the pipeline, especially with a code path that has never been taken before, adds its own risk and drops the trustworthiness of the entire system.
> Might as well design a system to avoid collision in the first place.
Agreed. But UUID accomplishes the goal of "designed to avoid collisions" by itself.
now, what to do with such an error? I think you should either log the error and retry with another uuid, or pass the error back to whoever called you (often the user, giving them an error page). Or maybe you will try for N times, and then return an error. what you can't do is to pretend everything is fine
if you do retry then it's just generating the uuid again with extra steps. i think this is fine
that's a new failure mode for sure, but not very different from other failures like connection loss to the db (also a fatal error, which in this case always should be surfaced to the caller). every networking API should have some possibility for error, and in this case this is just a new kind of error