String is the original API and PUBLISHER_DEFINED is a newer, more specific incarnation. Using a PUBLISHER_DEFINED hostid type is more secure compared to String, even though both are of the ?string? data type. String should almost never be used in Production. Note that the security around the publisher_defined hostid, while better than String, is not very strong and hence it is recommended for trusted environments or closed eco systems only.