Newsgroups: php.internals Path: news.php.net Xref: news.php.net php.internals:54092 Return-Path: Mailing-List: contact internals-help@lists.php.net; run by ezmlm Delivered-To: mailing list internals@lists.php.net Received: (qmail 58674 invoked from network); 19 Jul 2011 22:35:40 -0000 Received: from unknown (HELO lists.php.net) (127.0.0.1) by localhost with SMTP; 19 Jul 2011 22:35:40 -0000 Authentication-Results: pb1.pair.com header.from=scott@macvicar.net; sender-id=unknown Authentication-Results: pb1.pair.com smtp.mail=scott@macvicar.net; spf=permerror; sender-id=unknown Received-SPF: error (pb1.pair.com: domain macvicar.net from 209.85.210.170 cause and error) X-PHP-List-Original-Sender: scott@macvicar.net X-Host-Fingerprint: 209.85.210.170 mail-iy0-f170.google.com Received: from [209.85.210.170] ([209.85.210.170:41842] helo=mail-iy0-f170.google.com) by pb1.pair.com (ecelerity 2.1.1.9-wez r(12769M)) with ESMTP id CD/C0-48320-BB6062E4 for ; Tue, 19 Jul 2011 18:35:40 -0400 Received: by iym1 with SMTP id 1so4862287iym.29 for ; Tue, 19 Jul 2011 15:35:37 -0700 (PDT) Received: by 10.231.159.133 with SMTP id j5mr7422151ibx.98.1311114937472; Tue, 19 Jul 2011 15:35:37 -0700 (PDT) Received: from [172.24.140.69] ([66.220.144.74]) by mx.google.com with ESMTPS id v16sm3889904ibe.0.2011.07.19.15.35.36 (version=SSLv3 cipher=OTHER); Tue, 19 Jul 2011 15:35:36 -0700 (PDT) Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Date: Tue, 19 Jul 2011 15:35:34 -0700 Message-ID: <37923B5A-3A77-47EA-8319-A23D3C1DFE5B@macvicar.net> Cc: Pierre Joye To: PHP internals Mime-Version: 1.0 (Apple Message framework v1084) X-Mailer: Apple Mail (2.1084) Subject: Subverting OpenSSL library function with Windows alternatives From: scott@macvicar.net (Scott MacVicar) Just noticed a commit from Pierre last week = http://svn.php.net/viewvc?view=3Drevision&revision=3D313112 which = changed OpenSSL to use a special Windows API call for gathering random = data. I've reverted this change so we can discuss this further. I disagree with advertising a library function and changing it to use = something else. Especially when this is around random data / encryption. = The OpenSSL library has been audited externally, if there is a better = alternative then this patch should go upstream rather than being hacked = into PHP. If we want to offer this as win32_random_data() then I'm also fine with = that. - Scott=