Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:120597
Content-Type: multipart/alternative;
 boundary="------------ZwWyGqlXrfHDPjSJBgZYs51J"
Message-ID: <4cf80ee8-d1df-a021-78db-db9b68e8eef9@gmail.com>
Date: Thu, 15 Jun 2023 19:24:59 +0100
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101
 Thunderbird/102.12.0
To: internals@lists.php.net
References: <CAH5C8xWAsRV+8h-tZ2Xq0=tn753kbSQX=KSEYsE2fWEtQVMrew@mail.gmail.com>
 <CAMs36HfmXuUJWJ0uih+Pj_vui4wG4vy3OTMmmspGmpP9h_gvgw@mail.gmail.com>
 <9ea3a5af-679d-ad63-f9c2-e0d8d148db3f@bastelstu.be>
 <CABTDVhDPLwBHDDzfXcHhs4VZNMHswWqum9muKgZcA63sgMCZdg@mail.gmail.com>
 <5ca4e382-8284-1cd0-696f-0dfd693523f8@bastelstu.be>
 <CAH5C8xWnAjep7kkTSg3=koBd7U0XuBkwF0-k61Mvv1J-m5yRiQ@mail.gmail.com>
 <CALKiJKrP5n=i_MLqny_+bxVyUopQZYvKYrO0wgCvvFDtnji_=Q@mail.gmail.com>
 <5604f988-5ca5-6aca-72ee-8b45320a9836@bastelstu.be>
Content-Language: en-GB
In-Reply-To: <5604f988-5ca5-6aca-72ee-8b45320a9836@bastelstu.be>
Subject: Re: [PHP-DEV] [RFC] [Discussion] PHP 8.3 deprecations
From: rowan.collins@gmail.com (Rowan Tommins)

--------------ZwWyGqlXrfHDPjSJBgZYs51J
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit

On 15/06/2023 13:14, Tim Düsterhus wrote:
> Looping back to the beginning of my email: The recommended replacement 
> is random_int() which is available for years, but the "organic" 
> migration did not really work.


I think that's partly because, rightly or wrongly, random_int() is not 
generally viewed as a universal replacement for rand()/mt_rand(). For 
instance, consider the opening description in the manual for random_int():

 > Generates cryptographic random integers that are suitable for use 
where unbiased results are critical, such as when shuffling a deck of 
cards for a poker game.

And the Caution on the manual for rand() and mt_rand():

 > This function does not generate cryptographically secure values, and 
/must not/ be used for cryptographic purposes, or purposes that require 
returned values to be unguessable.

Note that both talk about using random_int() *in particular situations*, 
not as a universal replacement.

Add to that the scary fact that random_int() can fail with an exception 
(the technical detail of how unlikely that is probably goes over the 
head of the majority of PHP programmers), and the perception that it's 
significantly slower (which may or may not be true, or relevant to most 
users), and many people will be actively choosing not to use it when 
they don't need its guarantees.


On the other hand, I'm sure you're right that there are people misusing 
rand()/mt_rand() in contexts where they really should use something 
secure. Maybe with improved documentation at the same time, a 
deprecation could be OK; but it would be worryingly easy to say 
"deprecate first, we'll get round to the documentation later", and have 
lots of confused users who think we're suddenly deprecating something 
that's been working fine for 20 years.

Regards,

-- 
Rowan Tommins
[IMSoP]

--------------ZwWyGqlXrfHDPjSJBgZYs51J--