Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:73303
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain devilix.net designates 209.85.213.53 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAH-PCH5Epq9SsArGFiGUfBWW-gfprhNYS1tQ=L4L+K9+OWaRfQ@mail.gmail.com>
References: <CAPhkiZz4bN8XQOtkeyXMArgdngHVjHY+0gf-Qnb9RY8xrxOZTg@mail.gmail.com>
	<CAGa2bXbF5ip_rzt+P3vc1ReEU-RoP5vGOnrTTDpTLeMGSLDrAg@mail.gmail.com>
	<CAPhkiZxAc_88dt469JuiAXrkRoDLfJ=Mtcasqr6vLcj_iDg1ig@mail.gmail.com>
	<CAGa2bXb5inv+aw8Y1502E+iHQautNggJaHj8RvqsAdo4MAgCDw@mail.gmail.com>
	<CAPhkiZxiXdHYo90cm=uZ+t2+DOuh9OWmkVNnnAGXC=TfznCvXw@mail.gmail.com>
	<CAGa2bXaU8g6eApd+u4G5LZCkBhR=Qt3NmL0gyGxxQztZr4gxvA@mail.gmail.com>
	<CAH-PCH5Epq9SsArGFiGUfBWW-gfprhNYS1tQ=L4L+K9+OWaRfQ@mail.gmail.com>
Date: Wed, 19 Mar 2014 17:22:07 +0200
Message-ID: <CAPhkiZz4Uyd-Ga=m8Xn-dH8wmRy-RDMGd8HPNg5nDxDyCNGTag@mail.gmail.com>
To: Ferenc Kovacs <tyra3l@gmail.com>
Cc: Yasuo Ohgaki <yohgaki@ohgaki.net>, "internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] Solution for session_regenerate_id() issues
From: narf@devilix.net (Andrey Andreev)

Hi,

On Wed, Mar 19, 2014 at 12:12 PM, Ferenc Kovacs <tyra3l@gmail.com> wrote:
>> If you choose "security" bug type, it's hidden.
>
>
> nope, security bug type only makes it send the bug mail to security@php.net,
> only private bugs are protected from public access.
> that is something really error-prone, so I remember some discussion about
> changing that, and making new security bugs to be private by default, but
> AFAIK we never implemented that.

Actually, somebody did implement it.
Turned out the issue I wanted to report is solved though ... it was
the regression with use_strict_mode in 5.5.3 and for some unknown
reason, Ubuntu is sticking exactly to that version.

On topic: I understand the gains, Yasuo.
But I completely disagree that it's mandatory or that it is PHP's job
at all. If I tell PHP to delete something, I expect it to do so,
immediately.

Cheers,
Andrey.