Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:109973
Message-ID: <C4580849-BC5B-45CA-9B57-56CB63B3F8F0@benramsey.com>
Content-Type: multipart/signed;
	boundary="Apple-Mail=_F789607B-D32B-458B-85D1-B92613EA1495";
	protocol="application/pgp-signature";
	micalg=pgp-sha256
Mime-Version: 1.0 (Mac OS X Mail 13.0 \(3608.60.0.2.5\))
Date: Sat, 2 May 2020 14:13:25 -0500
In-Reply-To: <9e3b1604-8d0a-9db4-aab6-e5f2198252f4@allenjb.me.uk>
Cc: PHP Internals <internals@lists.php.net>
To: AllenJB <php.lists@allenjb.me.uk>
References: <9e3b1604-8d0a-9db4-aab6-e5f2198252f4@allenjb.me.uk>
Subject: Re: [PHP-DEV] Deprecating uniqid()
From: ben@benramsey.com (Ben Ramsey)

--Apple-Mail=_F789607B-D32B-458B-85D1-B92613EA1495
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=us-ascii

> On May 2, 2020, at 13:57, AllenJB <php.lists@allenjb.me.uk> wrote:
>=20
> Hi all,
>=20
> I'd like to discuss deprecating uniqid()
>=20
> I believe it's dangerously bad a doing "what it says on the tin". New =
developers still reach for it and do not read the warnings on the manual =
page (or if they do, don't fully understand how bad it is).
>=20
> For older codebases that still rely on it, a userland replacement can =
be easily implemented (and could be published on Packagist).
>=20
> I noticed there was an RFC [0][1] brought up 2 years ago, but was =
never voted on. Does anyone know why this was?
>=20
> [0] https://externals.io/message/102097
> [1] https://wiki.php.net/rfc/deprecate-uniqid
>=20
> Is there interest in deprecating this function?
>=20
> If not deprecation, how could it be (further) "improved"? My first =
thought is to make the "more entropy" option enabled by default (the =
argument could remain so that it can be disabled by codebases that rely =
on the lower length and can take the tradeoffs).


Instead of deprecating and removing it, would anyone be opposed to =
replacing the internals of the function so that it uses `random_bytes()` =
under the hood, while all other functionality remains the same?

Cheers,
Ben

--Apple-Mail=_F789607B-D32B-458B-85D1-B92613EA1495
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
	filename=signature.asc
Content-Type: application/pgp-signature;
	name=signature.asc
Content-Description: Message signed with OpenPGP

-----BEGIN PGP SIGNATURE-----

iHUEAREIAB0WIQToXQMR3fpbrPOmEOewLZeYnIwHGwUCXq3GVQAKCRCwLZeYnIwH
G3m7AP9j7KHCVzHlT1ewEkCxutpG01DS5beMEqxD8o6kxQYXKwD+MsD48hDrwxvd
9mr2dqX4cO/M5z04HKUFCd0e7A4dqlU=
=ePRW
-----END PGP SIGNATURE-----

--Apple-Mail=_F789607B-D32B-458B-85D1-B92613EA1495--