Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:92396
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.192.172 as permitted sender)
To: Yasuo Ohgaki <yohgaki@ohgaki.net>
References: <CAGa2bXb-jON8qZyje_ETckyO-KCmcbhTjcJt=NJZ1agAgzqMoQ@mail.gmail.com>
 <CAPhkiZx7zc1=1zyx=vJvZtr7x7OhktDFCHMK4GdOCD_DSqbKCg@mail.gmail.com>
 <CAGa2bXaZnsGnrKAAPmxHG+hut3+1=8bdOER--WrsXXowoiXu=A@mail.gmail.com>
 <CAPhkiZyHruaK9NM4C-4PcQ-2x4QK52Lv+JAyhLHoP=ufcufjWw@mail.gmail.com>
 <CAGa2bXb14ucv2PyHeVHMTcvUrqXD+QehqYHiBZtsqcXW1tgjXA@mail.gmail.com>
 <570D2F74.7060702@gmail.com>
 <CAGa2bXaysM4jcdOzW9ZXzFD_XOgkxphTH_JC0__HEYTNeCniHw@mail.gmail.com>
 <57115F42.2030502@gmail.com>
 <CAGa2bXYSLBXPQ_JRFFDt_mPqjY5JL8qo-K2teZ8xn6ja2T7gbA@mail.gmail.com>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Message-ID: <57148F7C.1070104@gmail.com>
Date: Mon, 18 Apr 2016 00:40:44 -0700
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:38.0)
 Gecko/20100101 Thunderbird/38.7.1
MIME-Version: 1.0
In-Reply-To: <CAGa2bXYSLBXPQ_JRFFDt_mPqjY5JL8qo-K2teZ8xn6ja2T7gbA@mail.gmail.com>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] [RFC][Discussion] Add session_gc()
From: smalyshev@gmail.com (Stanislav Malyshev)

Hi!

> Probability based GC is unreliable and can reactivate very old sessions
> without "Precise session management RFC" and you opposed the RFC.

You know why I opposed the RFC - because it had huge number of things
packed together, some of which I agree with, some of which I disagree
and some of which I agree in principle, but would like to do in other
ways. I thought that the RFC would be much better to split up, and was
arguing so, but you decided it is better to proceed with everything as
one package, which is your right as RFC author, but it failed. So now it
is time to consider it piece by piece.

I think session_gc() would be a good addition, but I oppose the idea
that it should be the *only* method of GC. Many sites would have hard
time working with this method, either because of not having cron access
or not being able to configure it correctly, and would just resort to
implementing probabilistic GC anyway, introducing myriad of bugs on the
way. And the fact is, for most sites probabilistic GC works nicely. Only
sites that have very low traffic and very short session lifetimes would
have any issue with probabilistic GC.

If you have a site with 10 requests per second, and have GC with
probability of 1%, then it is functionally equivalent of doing manual GC
once per 10 seconds. Of course, you don't know when exactly, but a) cron
doesn't exactly guarantee precise timing either and b) I do not see why
it would be so important for a common application if the session is
cleaned up after 10 or 12 seconds.

There are other questions with regard to old sessions - but those are
not very relevant to GC model so I do not discuss them here. We can
discuss them separately.

> Reactivating obsoleted/should be deleted session is wrong simply.
> Why users shouldn't matter?

I never said "users shouldn't matter", so please do not ascribe it to
me. Of course users matter, that's why we are doing all this. The
question is how to help them.

I appreciate that you think manual GC is superior, and I fully support
inclusion of that option into PHP. What I however can not support is to
make this the only option, contrary to what worked in PHP for nearly two
decades. I want both your opinion and opinions different from yours to
be accommodated, and to that goal I propose to support both ways to do
GC and let the user choose which one is best for them.
-- 
Stas Malyshev
smalyshev@gmail.com