Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:80425
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain lerdorf.com designates 209.85.216.179 as permitted sender)
Message-ID: <54B46661.7080001@lerdorf.com>
Date: Mon, 12 Jan 2015 16:27:13 -0800
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.3.0
MIME-Version: 1.0
To: Andrea Faulds <ajf@ajf.me>
CC: Stanislav Malyshev <smalyshev@gmail.com>, 
 Yasuo Ohgaki <yohgaki@ohgaki.net>,
 PHP Internals List <internals@lists.php.net>
References: <E472413E-7615-49F9-BE6C-AAA0088C3F53@ajf.me> <54B30DB9.3000003@seld.be> <76B8D342-43E7-42E6-AD82-FCF7C5CA8658@ajf.me> <54B31D77.9010100@gmail.com> <976B7B2E-7BC9-4514-ABF3-C0DA3ED98897@ajf.me> <54B32145.80501@gmail.com> <B3E640CE-0361-4132-A849-20AFFC9D7AA8@ajf.me> <54B32BEA.5090507@gmail.com> <54B38EA6.8070402@lerdorf.com> <47FF88D5-14F8-4844-A9DD-51532FBF3588@ajf.me>
In-Reply-To: <47FF88D5-14F8-4844-A9DD-51532FBF3588@ajf.me>
Content-Type: multipart/signed; micalg=pgp-sha1;
 protocol="application/pgp-signature";
 boundary="BAWoVVUEwAAu92BUEstgVXHhSL1TlUTGl"
Subject: Re: [PHP-DEV] rand(), mt_rand() and limits
From: rasmus@lerdorf.com (Rasmus Lerdorf)

--BAWoVVUEwAAu92BUEstgVXHhSL1TlUTGl
Content-Type: text/plain; charset=windows-1252
Content-Transfer-Encoding: quoted-printable

On 01/12/2015 01:31 AM, Andrea Faulds wrote:
> Hi Rasmus,
>=20
>> On 12 Jan 2015, at 09:06, Rasmus Lerdorf <rasmus@lerdorf.com> wrote:
>>
>> Yes, there is plenty of code out there that relies on srand()+rand()
>> returning a repeatable sequence of pseudo-random numbers. I have writt=
en
>> some myself. C devs are very familiar with this behaviour of srand.
>=20
> C devs are also familiar with the usage of strtok, but it doesn't make =
an API with global state any less flawed.
>=20
> The problem with rand() and srand() is they're used for three different=
 purposes, only one of which they're terribly fitting for:
>=20
> - To produce a non-repeatable sequence of random numbers (works OK if s=
rand() isn't used)
> - To produce a repeatable sequence of random numbers (works, but only i=
f you and the sole user of the global random number  generator, which is =
not guaranteed by any means)

Well, luckily PHP is not multi-threaded for the majority of PHP uses so
you can be pretty sure you are the only user in your process. I suppose
if you are in some massive framework and you have no idea what your
framework is doing you could perhaps run into problems, but then you
have other issues. Assuming you know what you are doing on a single
request you get a guaranteed repeatable sequence of numbers and this is
a super useful feature that we can't just arbitrarily kill because you
think some people might use it incorrectly.

-Rasmus


--BAWoVVUEwAAu92BUEstgVXHhSL1TlUTGl
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iEYEARECAAYFAlS0ZmEACgkQlxayKTuqOuBu5ACeNbcor3Cdygm3DNOh5+UFwf4/
QMQAni1E7NouFmgE0CibFAy9rmoxL/le
=gNuk
-----END PGP SIGNATURE-----

--BAWoVVUEwAAu92BUEstgVXHhSL1TlUTGl--