A bit of a bizarre post since to_sgid has existed forever to generate signed global ids. Global IDs are probably one the most powerful and underrated features of Rails but regular global ids are only supposed to be used internally (e.g. job params) and never sent to the client.If there’s a gotcha it’s that _signed_ global ids are only signed, not encrypted, and very few people seem to know about the optimised method (globalid::Locator.locate_many) for loading a batch of global ids

The original comment is valid though, this has nothing to do with GIDs, standard &#x2F;:id&#x2F; routes, and Model.find() can suffer the same issue. Probably because &quot;22ecb3fd-5e25-462c-ad2b-cafed9435d16&quot;.to_i is still 22?

Sure but the real concern of the article that if passed &quot;gid:&#x2F;&#x2F;moneymaker&#x2F;Invoice&#x2F;22ecb3fd-5e25-462c-ad2b-cafed9435d16&quot; the global id locator will effectively locate &quot;gid:&#x2F;&#x2F;moneymaker&#x2F;Invoice&#x2F;22&quot;. Which is to say, that what is supposed to be a system-generated id which has no need for de-slugification, uses the same lookup method as is normally used for URLs which attempts to de-slugify.Obviously, this means that first gid was bogus anyway, as it was trying to look up via the wrong key, but the fact that it doesn&#x27;t fail, and will instead return the record with primary key &quot;22&quot; can certainly be surprising.

If you don&#x27;t want invoice 22 to be shown by someone putting 22 on the url, you definetly need to enforce permissions on your app. The Global ID issue is tangential to that.

I struggle to understand what this specifically has to do with rails or global IDs. In ANY framework or query system, if you are asking an LLM to produce IDs which you are then passing to a database for lookup, you need to understand those identifiers could be hallucinated or incorrect in surprising or malicious ways, and can lead to data leaks or exfiltration.It&#x27;s like writing an article about &quot;the dangers of PostgreSQL&quot; ... when generating SQL from an LLM. It has nothing to do with Postgres specifically, it&#x27;s that you&#x27;re generating queries to run in a trusted context from an untrustable origin.

Agreed. Seems like the author tried to get fancy using GIDs with LLMs to cut down on the logic in their tool calls and opened a can of worms.

&gt; GIDs are not checked for authorization when doing the lookup - they are meant to be generated above the authorization layer, and to be consumed above the authorization layerThen the problem with this post boils down to applying the authorization layer in any tool call, just like you do in controllers. Seems obvious?

yeah, but if you say LLM is shit, and not rails... goodbye views :)

This title is odd, given the actual identified problem seems to be LLMs writing code.

So....LLMs can hallucinate GIDs. I hope that everyone is aware of that.

Or more like &quot;be careful with the power you give your LLMs&quot;

Shopify: <a href="https:&#x2F;&#x2F;shopify.dev&#x2F;docs&#x2F;api&#x2F;usage&#x2F;gids#global-id-structure" rel="nofollow">https:&#x2F;&#x2F;shopify.dev&#x2F;docs&#x2F;api&#x2F;usage&#x2F;gids#global-id-structure</a>

Shopify <a href="https:&#x2F;&#x2F;shopify.dev&#x2F;docs&#x2F;api&#x2F;usage&#x2F;gids" rel="nofollow">https:&#x2F;&#x2F;shopify.dev&#x2F;docs&#x2F;api&#x2F;usage&#x2F;gids</a>

Almost any modern rails apps that have a job queue will use this at some point

Any popular Rails apps that use to_global_id?

the AI hallucinated and somehow it&#x27;s rails fault?GID&#x27;s are great - i think the issue is with how they leveraged rubyLLM for something they should inherently not be using LLMs for.&gt; Remember that GIDs were made for facilitating ActiveJob serialization - they are a system-level facility, not a product-level facility.I think this is somewhat obvious given the signature like gid:&#x2F;&#x2F;awesome-app&#x2F;Post&#x2F;32; there is no scoping to the user or account so it should be treated like a global lookup. If you need scoping to a user&#x2F;account you can build that.Honestly I think this is a matter of the author using poor design decisions and over leveraging LLMs. But this is not the fault of Rails, it is working as expected.Be careful with LLMs!

Rails is a dangerous place to be throwing random data into APIs.

Be Careful with GIDs in Rails

Prediction: AI will make formal verification go mainstream

alpr.watch

No Graphics API

Ty: A fast Python type checker and LSP

<a href="https:&#x2F;&#x2F;platform.openai.com&#x2F;docs&#x2F;models&#x2F;gpt-image-1.5" rel="nofollow">https:&#x2F;&#x2F;platform.openai.com&#x2F;docs&#x2F;models&#x2F;gpt-image-1.5</a>

GPT Image 1.5

40 percent of fMRI signals do not correspond to actual brain activity

Mozilla appoints new CEO Anthony Enzor-Demeo

Chat-tails: Throwback terminal chat, built on Tailscale

Writing a blatant Telegram clone using Qt, QML and Rust. And C++

The World Happiness Report is beset with methodological problems

Thin desires are eating life

Japan to revise romanization rules for first time in 70 years

Sega Channel: VGHF Recovers over 100 Sega Channel ROMs (and More)

GitHub will begin charging for self-hosted action runners on March 2026

MIT professor shot at his Massachusetts home dies

Nvidia Nemotron 3 Family of Models

I work mostly in the terminal but found myself constantly switching to bloated GUIs like SSMS only for the simple task of browsing tables and run queries. And I didn&#x27;t find Existing SQL TUIs intuitive, having to read documentation to learn keybindings and CLI flags to connect. Given I had recently switched to linux, I found myself using vs code&#x27;s sql database extension. Something was awfully wrong.I wanted something like lazygit for databases – run it, connect, and query and frankly just make it enjoyable to access data.<pre><code> Sqlit is a keyboard-driven SQL TUI with:

 - Context-based keybindings (always visible)
 - Neovim-like interface with normal and insert mode for query editing
 - Browse databases, tables, views, stored procedures
 - Adapters for SQL Server, SQLite, PostgreSQL, Turso &amp; more
 - SSH tunneling support
 - Themes (Tokyo Night, Nord, Gruvbox etc.)

 Inspired by lazygit, neovim and lazysql. Built with Python&#x2F;Textual.
</code></pre>
Feedback welcome – especially on which adapters to prioritize next. My vision of sqlit is to make a tool that makes it easy to connect and query data, and to do that, and that thing only, really well.<a href="https:&#x2F;&#x2F;github.com&#x2F;Maxteabag&#x2F;sqlit" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;Maxteabag&#x2F;sqlit</a>