Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:73247
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain devilix.net designates 209.85.213.41 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAEZPtU5=1ZL8sn+YZqKOdfGi8zthuMu3YgkVaecY+v3Hfo7Mfg@mail.gmail.com>
References: <CAPhkiZzAxQnQpWOh7xhAM4h3r7xCYjD_P3d9mWmDX4Sr0Qc9Ng@mail.gmail.com>
	<CAGa2bXZHYJzcV2E-SDN7-u1_SLrW8Tr7hwkQG5JSnD-7oh-Xvg@mail.gmail.com>
	<CAPhkiZzRZSRH3LWQqL=mik1KJ8i=19QNatFPoK7TXZMru5SKZA@mail.gmail.com>
	<CAGa2bXaGRk0PipbF_DYSgcPNwLvs=8nb8yHG9XFawrNFUVmdyQ@mail.gmail.com>
	<CAEZPtU5=1ZL8sn+YZqKOdfGi8zthuMu3YgkVaecY+v3Hfo7Mfg@mail.gmail.com>
Date: Mon, 17 Mar 2014 23:59:51 +0200
Message-ID: <CAPhkiZyxdbb-yne9ZV-+-kaaR5ap8rbxTNAqcoz40YFdNhgDoQ@mail.gmail.com>
To: Pierre Joye <pierre.php@gmail.com>
Cc: Yasuo Ohgaki <yohgaki@ohgaki.net>, "internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] Session: deprecating create_sid() method and add createSid()?
From: narf@devilix.net (Andrey Andreev)

Hi,

On Mon, Mar 17, 2014 at 11:15 PM, Pierre Joye <pierre.php@gmail.com> wrote:
> hi,
>
> On Mon, Mar 17, 2014 at 10:09 PM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
>
> For one, I appreciate the effort that both of you put on the session management.
>
> It seems that you are somehow alone to discuss this issue and slightly
> in circle right now.
>
> I would suggest two steps:
>
> - sit down together for a chat and get your stuff together. It will by
> far more efficient than mails
>
> - write one or more RFCs to fix what should be fixed, how and why (see
> next point :)
>
> - provide more info about the actual critical security impact that
> could be fixed by the changes
>   as of now, I failed to see any CVE related to what you are referring to

We'll surely do that.
In fact, I was just about to write Yasuo a private mail about some
security issues, because I didn't find an option to report a bug and
make it hidden. Is there such an option, or does the CVE assignment
process allow that? (I'm not familiar with it)

Cheers,
Andrey.