Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:54094
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.213.170 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <37923B5A-3A77-47EA-8319-A23D3C1DFE5B@macvicar.net>
References: <37923B5A-3A77-47EA-8319-A23D3C1DFE5B@macvicar.net>
Date: Wed, 20 Jul 2011 00:54:35 +0200
Message-ID: <CAEZPtU6cOTaH2pNxBWwt7TZW9j0buLsJ+JgcW4wo8256efN+Tw@mail.gmail.com>
To: Scott MacVicar <scott@macvicar.net>
Cc: PHP internals <internals@lists.php.net>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Subject: Re: Subverting OpenSSL library function with Windows alternatives
From: pierre.php@gmail.com (Pierre Joye)

Scott,



On Wed, Jul 20, 2011 at 12:35 AM, Scott MacVicar <scott@macvicar.net> wrote=
:
> Just noticed a commit from Pierre last week http://svn.php.net/viewvc?vie=
w=3Drevision&revision=3D313112 which changed OpenSSL to use a special Windo=
ws API call for gathering random data.
>
> I've reverted this change so we can discuss this further.

There is nothing to discuss. The Windows implementation is just as
safe and is much faster than the OpenSsl API.

> I disagree with advertising a library function and changing it to use som=
ething else. Especially when this is around random data / encryption. The O=
penSSL library has been audited externally, if there is a better alternativ=
e then this patch should go upstream rather than being hacked into PHP.

I disagreed with the initial implementation of this function in the
1st place, for many reasons that we discussed back then. But you still
applied it. Now I don't want to have windows applications behind yet
again slower because of that and this change greatly improve this
function. So we keep it.


Cheers,
--=20
Pierre

@pierrejoye | http://blog.thepimp.net | http://www.libgd.org