Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:94226
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.161.179 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <D3915644.6FA67%fsb@thefsb.org>
References: <CAPwsocFZQdU2bt0OETeJMQYBXVUkK8ygB5jTb4ML3df4GZWdVA@mail.gmail.com>
 <e28227a3-d5b1-b971-3362-c6d31768aa44@fleshgrinder.com> <cf009374-d159-886c-3a25-643ebb7f91e5@gmail.com>
 <f5807c28-6f0e-d7a7-b460-335cb0354d07@seld.be> <2f92fa26-5f50-0e68-c1fc-de79f17c201e@fleshgrinder.com>
 <8b48f847-bbba-03f8-4b2e-9cd0841b484e@gmail.com> <65ea0142-c2d6-f4ed-e98e-b7c7fbc51c58@fleshgrinder.com>
 <CAF+90c9N3Mk99OOhLi_NgM6GKYhh0a5gXk2nH1fmnyqz=f0Zbw@mail.gmail.com> <D3915644.6FA67%fsb@thefsb.org>
Date: Thu, 23 Jun 2016 15:57:52 +0200
Message-ID: <CAF+90c9sONJVu6BFafM8h9DKOK6eaj+xsk_Jt3kd-DTVBVn6Fg@mail.gmail.com>
To: Tom Worster <fsb@thefsb.org>
Cc: Leigh <leight@gmail.com>, Rowan Collins <rowan.collins@gmail.com>, 
	PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a114d3b0ebe17260535f2702d
Subject: Re: [PHP-DEV] [RFC] RNG fixes
From: nikita.ppv@gmail.com (Nikita Popov)

--001a114d3b0ebe17260535f2702d
Content-Type: text/plain; charset=UTF-8

On Thu, Jun 23, 2016 at 3:18 PM, Tom Worster <fsb@thefsb.org> wrote:

> On 6/22/16, 5:19 PM, "Nikita Popov" <nikita.ppv@gmail.com> wrote:
>
> >I haven't been following this thread, just jumping in to comment on this
> >point. My suggestion to deprecate rand() was motivated by the fact that
> >rand() produces extremely low quality random numbers on Windows, while at
> >the same time having the name people are most likely to try first if they
> >want to have a random number. It's a bad state of things if there's a
> >rand() and an mt_rand() function and the latter is preferable in *all*
> >situations, while the former is more likely to be used. However, this
> >concern is completely alleviated by aliasing rand() to mt_rand(). If we
> >do this, I see no reason to deprecate rand(), at least in the short term.
>
> Alternatively, if you fix rand() by making *it* the new, fast,
> platform-independent RNG (e.g. Xoroshiro128+) and leave mt_rand() alone
> then:
>
> 1. The "bad state of things" you described is resolved.
>
> 2. The various complaints about mt_rand() become irrelevant because rand()
> will be preferable in *all* situations (except security and backwards
> compat).


Imho this is worst solution of all. This means that prior to PHP 7.1
mt_rand() is preferable in all cases and starting with PHP 7.1 rand() is
preferable in all cases. Have fun writing code for that.

I personally have no problem changing mt_rand() to use something other than
MT19937. Given the fact that mt_rand() has been producing random numbers
that do not conform to the MT19937 sequence for years and years and it was
only noticed recently we can say that, without any doubt, nobody is using
mt_rand() to obtain sequences compatible with external MT implementations.
As such it doesn't matter if we switch to something else (apart from the
fact that the sequence changes in *some* way, which is a given with all the
changes we're discussion here.)

Whatever we do, please maintain the invariant that mt_rand() >= rand() in
terms of quality. I recommend doing this by making mt_rand() == rand().

Regards,
Nikita

--001a114d3b0ebe17260535f2702d--