Having thought about this a little more, doesn't this approach lay you open to an easy denial of service attack? I may not have the resources of CPU or bandwidth to hammer a site using this technique, but it seems that the fnids are unique to the page they're generated for, perhaps because the time is part of the key, so by requesting a page enough times I can soon use up the 20,000 closures. This would cause "unknown fnid" errors for other users despite them having only recently generated the page.

Here's why I think this. Apologies for the formatting.

$ fnid() { wget -qO - "http://news.ycombinator.com/threads?id=${1?}" | tr '?"' '\n\n' | sed -n 's/^fnid=//p'; }

$ fnid ralph | sort 1

$ fnid ralph | sort 2

$ wc -l 1 2 | tr \\n ,

177 1, 177 2, 354 total,

$ comm 1 2 | sed 's/[^\t].//; s/./x/g; s/^/x/' | sort | uniq -c | tr \\n ,

177 x, 177 xx,

comm(1) is showing the two fnid lists are disjoint. 177 occur only in file 1. 177 occur only in file 2. 0 occur in both (xxx). 20,000 / 177 = 112.99, so 113 "fnid ralph" would flush the hash table.

I'm not trying to pick holes, just interested in the techniques that can be used and would welcome opinions.