Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:120460
MIME-Version: 1.0
References: <CAH5C8xWAsRV+8h-tZ2Xq0=tn753kbSQX=KSEYsE2fWEtQVMrew@mail.gmail.com>
 <CAMs36HfmXuUJWJ0uih+Pj_vui4wG4vy3OTMmmspGmpP9h_gvgw@mail.gmail.com> <9ea3a5af-679d-ad63-f9c2-e0d8d148db3f@bastelstu.be>
In-Reply-To: <9ea3a5af-679d-ad63-f9c2-e0d8d148db3f@bastelstu.be>
Date: Wed, 31 May 2023 00:52:30 +0900
Message-ID: <CABTDVhDPLwBHDDzfXcHhs4VZNMHswWqum9muKgZcA63sgMCZdg@mail.gmail.com>
To: PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="00000000000079e6c505fceb3121"
Subject: Re: [PHP-DEV] [RFC] [Discussion] PHP 8.3 deprecations
From: zeriyoshi@gmail.com (Go Kudo)

--00000000000079e6c505fceb3121
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

2023=E5=B9=B45=E6=9C=8830=E6=97=A5(=E7=81=AB) 4:49 Tim D=C3=BCsterhus <tim@=
bastelstu.be>:

> Hi
>
> On 5/29/23 08:44, Go Kudo wrote:
> > I realized I was about to add the deprecation of `lcg_value()` and forg=
ot
> > to do so, so I added it.
> >
> > https://wiki.php.net/rfc/deprecations_php_8_3#global_combined_lcg
> >
> > As usual, my English is of low quality, so I would appreciate it if you
> > could point out any problems.
>
> I think it's too early for that. Because:
>
> 1. The replacement is only available as of PHP 8.3. Thus there won't be
> a single version where "replacement is available" and "the function does
> not emit deprecation notices" is both true. It should be deprecated with
> PHP 8.4 at the earliest to give folks at least (!) one version to
> cleanly migrate existing code without suppressing any errors / notices /
> deprecations.
>
> 2. It's not seedable, thus the implementation can be switched to use a
> different engine without affecting existing code.
>
> 3. It's not as commonly misused as mt_rand() is. Primarily because the
> possible use-cases are much more rare.
>
> Best regards
> Tim D=C3=BCsterhus
>
> --
> PHP Internals - PHP Runtime Development Mailing List
> To unsubscribe, visit: https://www.php.net/unsub.php
>
>
Hi

 > It should be deprecated with PHP 8.4 at the earliest to give folks at
least

Indeed, I agree that `lcg_value()` should be deprecated at least in PHP 8.4=
.

However, `lcg_value()` remains a dangerous function. It still has a weak
initial seeding problem (PID, time), not to mention global state. This is
extremely dangerous for workloads on containers where PIDs tend to be
fixed. Perhaps this should be documented at the time of PHP 8.3 release.

Because of the above, I have removed my `lcg_value()` deprecation entry
from the RFC. Thanks!

Best Regards,
Go Kudo

--00000000000079e6c505fceb3121--