Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:68613
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.220.171 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAGa2bXZgvanr6s2c-QECGuE3K1F9KKBVDA_sc_t=iR66d5So1g@mail.gmail.com>
References: <CAGa2bXZPkeu0Ns_o2Q4Xe_XM8SqmD8hg9oyjOrbZFS0G1C5t2g@mail.gmail.com>
	<CALtuQzCX-tu7SjZDjM=fW26UXDWoLaKYyZVnX-6DFVj+x3ujyw@mail.gmail.com>
	<CAPwsocGU5ewAKE4cqX=BFQYqZ65=fAjKfVuQut8H2SDw76UAbg@mail.gmail.com>
	<CAGa2bXZgvanr6s2c-QECGuE3K1F9KKBVDA_sc_t=iR66d5So1g@mail.gmail.com>
Date: Fri, 23 Aug 2013 10:12:45 -0400
Message-ID: <CAAyV7nEh7YDQj1nMkSGpyfaSYxG+9YbGPuVFMY6geNR_XNs=9w@mail.gmail.com>
To: Yasuo Ohgaki <yohgaki@ohgaki.net>
Cc: Leigh <leight@gmail.com>, Sebastian Krebs <krebs.seb@gmail.com>, 
	"internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a11c2487a30ed3d04e49e00b6
Subject: Re: [PHP-DEV] Request #65501 uniqid(): More entropy parameter should
 be true by default
From: ircmaxell@gmail.com (Anthony Ferrara)

--001a11c2487a30ed3d04e49e00b6
Content-Type: text/plain; charset=ISO-8859-1

Yasuo,

> It's absolutely not wise to use it for anything security related, the
> > purpose of the function is simply to provide a unique value within a
> > system, not a random value, not an unpredictable value.
> >
>
> I agree.
>
> However, I suppose there are many applications that rely on uniqid() for
> critical features like payment or authentication.
>

Sure, and people use `eval()` for conditionals and `goto` for code
structure.

We shouldn't alter language design for people making bad decisions.
Instead, we should work on documentation and education to fix those kinds
of problems.


> We need better function as basic feature of PHP. unique_hash() or
> hash_unique() might be good. UUID works and is much better but generating
> unique hash just like session ID is trivial to implement.
>

What would this do? How would it work? Would it just be a statistically
unique hash? At which point why have it named on `hash` instead of just
being a large random number (and hence belongs as a random number
generator, not a unique hash thingy)...

My $0.02.

Anthony

--001a11c2487a30ed3d04e49e00b6--