Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:89028
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain thefsb.org designates 173.203.187.107 as permitted sender)
User-Agent: Microsoft-MacOutlook/14.5.7.151005
Date: Sun, 01 Nov 2015 15:02:47 -0500
To: Leigh <leight@gmail.com>
CC: <internals@lists.php.net>
Message-ID: <D25BD98B.671B4%fsb@thefsb.org>
Thread-Topic: Make sessions use php_random_bytes in 7.1
References: <CAPwsocFbM1wYzNni_M02Vd4m4giVeH36RH8uhWfC-uk_uaSqNw@mail.gmail.com>
 <563638C6.3010304@thefsb.org>
 <CAPwsocH6by-g5ZmbQZC1q5gZUovF5JNkCyUQg8hFtpDEPBm=6A@mail.gmail.com>
In-Reply-To: <CAPwsocH6by-g5ZmbQZC1q5gZUovF5JNkCyUQg8hFtpDEPBm=6A@mail.gmail.com>
Mime-version: 1.0
Content-type: text/plain;
	charset="UTF-8"
Content-transfer-encoding: 7bit
Subject: Re: Make sessions use php_random_bytes in 7.1
From: fsb@thefsb.org (Tom Worster)

On 11/1/15, 12:40 PM, "Leigh" <leight@gmail.com> wrote:

>On 1 November 2015 at 16:07, Tom Worster <fsb@thefsb.org> wrote:
>
>
>I don't have one.
>
>But if I may ask, I'm curious, as always: What happens in the case that
>php_random_bytes() fails?
>
>Tom
>
>
>That's a good point.
>
>session_start() would throw the exception generated by php_random_bytes()
>letting you know your system is incapable of generating high quality
>random numbers.

I think that's entirely satisfactory.



>However this is a serious issue in it's own right, the APIs used (and the
>way they are used) really only fail if the underlying environment is
>fubar.

Agreed.

Tom