Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:88779
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.217.181 as permitted sender)
To: internals@lists.php.net
References: <D241C8B9.65E53%fsb@thefsb.org>
Message-ID: <561D1AB4.5000303@gmail.com>
Date: Tue, 13 Oct 2015 15:52:36 +0100
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101
 Thunderbird/38.3.0
MIME-Version: 1.0
In-Reply-To: <D241C8B9.65E53%fsb@thefsb.org>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] Port random_bytes to PHP 5
From: rowan.collins@gmail.com (Rowan Collins)

Tom Worster wrote on 13/10/2015 01:29:
> Could we regard random_bytes() as a security patch rather than a new
> feature and therefore port it to PHP 5?

Whether or not it's good for security, it's still a feature - you still 
have to code your application to depend on this feature being present, 
or provide some kind of polyfill.

Adding functions in patch versions is very messy, IMHO, because in 
practice people will be using packaged binaries. Distros like 
Debian/Ubuntu actually roll their own patch releases rather than using 
the official release versions; other distros might simply lag behind; 
applications need to support multiple environments which aren't equally 
up to date, etc.

There may need to be a concerted campaign of "don't be scared to upgrade 
to PHP 7", but ultimately having people want the features in it is a 
Good Thing, and the more you backport, the more you fragment the ecosystem.

Regards,
-- 
Rowan Collins
[IMSoP]