Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:72779
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain rouvenwessling.de designates 5.35.242.46 as permitted sender)
Content-Type: multipart/alternative; boundary="Apple-Mail=_A801C74F-E3E4-45E2-AE7A-94A117829609"
Mime-Version: 1.0 (Mac OS X Mail 7.0 \(1822\))
In-Reply-To: <C020482C-6A5B-4A02-8196-F98AB117C35E@ajf.me>
Date: Mon, 24 Feb 2014 00:01:45 +0100
Cc: Stas Malyshev <smalyshev@sugarcrm.com>,
 Nikita Popov <nikita.ppv@gmail.com>,
 PHP internals <internals@lists.php.net>
Message-ID: <050FCE90-536A-4F1B-BF7B-938BB6FA3F25@rouvenwessling.de>
References: <BE8DBAE8-8B03-4834-8553-90DB69B0CD54@rouvenwessling.de> <CAF+90c-9Zva1TJySnGrs6ue0iBX=dXdmWEh+VzWVb71zy+6R9g@mail.gmail.com> <530A5899.1050203@sugarcrm.com> <C020482C-6A5B-4A02-8196-F98AB117C35E@ajf.me>
To: Andrea Faulds <ajf@ajf.me>
Subject: Re: [PHP-DEV] [PHP6] Merging rand and mt_rand()
From: me@rouvenwessling.de (=?iso-8859-1?Q?Rouven_We=DFling?=)

--Apple-Mail=_A801C74F-E3E4-45E2-AE7A-94A117829609
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=us-ascii


On 23.02.2014, at 22:53, Andrea Faulds <ajf@ajf.me> wrote:

>=20
> On 23 Feb 2014, at 20:22, Stas Malyshev <smalyshev@sugarcrm.com> =
wrote:
>> I would say anybody who relies on RNG producing preset numbers is =
asking
>> for trouble. If you need mock RNG, mock it out, don't rely on
>> undocumented properties of the system one.
>> But then again, refactoring and unifying RNGs is not very urgent =
thing
>> and a good candidate to put in a major version.
>=20
>=20
> What? PRNGs guarantee that for a given seed they will always produce =
the same sequence. All sorts of things do and should rely on this.

As far as rand() is concerned, this already doesn't work. As it's using =
the system rand it might change behavior when changing to a different OS =
for example. In this regards the change actually helps.

That said, I think it's a very bad idea to use a non-random seed with =
mt_srand() or srand() as a lot of code fall backs to them when no secure =
alternative exists. Also some library may use them to decide things that =
should actually be random. Maybe it would be a good idea to deprecate =
those and not include them in PHP6? It's probably safer to provide a =
dedicated sequence generator, than having people abuse our PRNGs.


--Apple-Mail=_A801C74F-E3E4-45E2-AE7A-94A117829609--