Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:87881
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.215.46 as permitted sender)
Content-Type: text/plain;
	charset=us-ascii
Mime-Version: 1.0 (1.0)
In-Reply-To: <20150823153705.F0BDD26052F@dd15934.kasserver.com>
Date: Sun, 23 Aug 2015 19:27:59 +0300
Content-Transfer-Encoding: quoted-printable
Message-ID: <092B2991-5D96-48E2-882D-ABF9DAAC3AC3@gmail.com>
References: <20150823153705.F0BDD26052F@dd15934.kasserver.com>
To: internals@lists.php.net
Subject: Re: [PHP-DEV] [RFC] [Discuss] Random Functions Throwing Exceptions in PHP 7.0.0
From: inefedor@gmail.com (Nikita Nefedov)



> On 23 Aug 2015, at 18:37, Thomas Bley <mails@thomasbley.de> wrote:
>=20
>=20
> consider this code:
>=20
> declare(strict_types=3D0);
> ini_set('display_errors', '1');
>=20
> function get_random_int(): int {
> return false;
> }
> echo get_random_int();
>=20
> and then use strict_types=3D1

So you're implying that in case of returning false with strict_types turned o=
n that would just throw a TypeError? That would be a bug in PHP. If you were=
 saying that in this case it should throw a different kind of error (the one=
 that was proposed by Anthony initially) then it wouldn't make sense again b=
ecause then you're creating a straight relation between having strict_types m=
ode turned on and random_int() throwing exception about not getting a reliab=
le source of entropy.


> Even correct return values of random_int() might create bad passwords.
> So I propose to have a function in core which tests the strength of the pa=
ssword:
>=20
> $password =3D '';
> for ($i =3D 0; $i < 10; $i++) {
> $password .=3D $characters[random_int(0, 30)];
> }
> if (password_strength($password) < PHP_PASSWORD_STRONG) {
>   throw new Exception("password not strong enough");
> }

I don't think it's a good idea, a language delivers features that user would=
 have a hard time implementing themselves, a small blocks from which you can=
 build whatever you want. A function that checks if a string contains alpha-=
numeric symbols as well as punctuation is pretty easy to implement in user l=
and.

PS sorry Thomas, I sent it to you personally, not to ML=