Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:120430
Feedback-ID: id4a9467a:Fastmail
User-Agent: Cyrus-JMAP/3.9.0-alpha0-441-ga3ab13cd6d-fm-20230517.001-ga3ab13cd
Mime-Version: 1.0
Message-ID: <b6af7ea0-4d4e-4644-aed0-fee97a23ddbd@app.fastmail.com>
In-Reply-To: 
 <CAH5C8xWAsRV+8h-tZ2Xq0=tn753kbSQX=KSEYsE2fWEtQVMrew@mail.gmail.com>
References: 
 <CAH5C8xWAsRV+8h-tZ2Xq0=tn753kbSQX=KSEYsE2fWEtQVMrew@mail.gmail.com>
Date: Mon, 29 May 2023 17:41:14 +0200
To: =?UTF-8?Q?M=C3=A1t=C3=A9_Kocsis?= <kocsismate90@gmail.com>,
 "Levi Morrison" <internals@lists.php.net>
Content-Type: multipart/alternative;
 boundary=f45a634ad7c0433482a47aedfce1e922
Subject: Re: [PHP-DEV] [RFC] [Discussion] PHP 8.3 deprecations
From: nikita.ppv@gmail.com ("Nikita Popov")

--f45a634ad7c0433482a47aedfce1e922
Content-Type: text/plain;charset=utf-8
Content-Transfer-Encoding: quoted-printable

On Mon, May 29, 2023, at 08:05, M=C3=A1t=C3=A9 Kocsis wrote:
> Hi Everyone,
>=20
> Together with multiple authors, we'd like to start the discussion of t=
he
> usual
> deprecation RFC for the subsequent PHP version. You can find the link =
below:
> https://wiki.php.net/rfc/deprecations_php_8_3
>=20
> Regards:
> M=C3=A1t=C3=A9 Kocsis

I don't think we should deprecate mt_rand().

There are plenty of use-cases that require neither a seedable (predictab=
le) RNG sequence, nor a cryptographically-secure RNG. For those use-case=
s (and especially one-off uses), mt_rand() is perfect, and going through=
 Randomizer is an entirely unnecessary complication.

I think I could get on board with deprecating srand/mt_srand to make ran=
d/mt_rand non-seedable, directing people who need a seedable RNG to use =
Randomizer, which is much better suited to that use-case. However, we sh=
ould retain rand/mt_rand themselves for non-seeded use-cases.

With srand/mt_srand removed, we also would not have to produce any parti=
cular sequence, and would be free to switch the internal RNG to somethin=
g other than Mt19937.

The same extends to array_rand(), shuffle() and str_shuffle() -- in fact=
 the RFC is missing an important voting option, which is "leave them alo=
ne", or rather "convert to some non-seedable non-CSPRNG" if you prefer.

Regards,
Nikita
--f45a634ad7c0433482a47aedfce1e922--