Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:94320
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.214.176 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <3dd66d47-9196-f1fd-82b6-ee0039c4da0d@gmail.com>
References: <CAGa2bXY3Zdrq-vU6_gCJVC3smP7DooBsKFNmQpz=ksdKsQORbQ@mail.gmail.com>
 <CAGa2bXaCLYTxSOuHHabYZSd=O07K5WU-fonki_5GNgWP=rNctg@mail.gmail.com> <3dd66d47-9196-f1fd-82b6-ee0039c4da0d@gmail.com>
Date: Wed, 29 Jun 2016 14:48:26 +0700
Message-ID: <CAEZPtU69-fHrWy1GdXr1c0iTr2itYj5vz-teqEJ_HCOoZibumg@mail.gmail.com>
To: Stanislav Malyshev <smalyshev@gmail.com>
Cc: Yasuo Ohgaki <yohgaki@ohgaki.net>, "internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] Re: [RFC][DISCUSSION] Session ID without hashing
From: pierre.php@gmail.com (Pierre Joye)

Hi :)

On Wed, Jun 29, 2016 at 7:09 AM, Stanislav Malyshev <smalyshev@gmail.com> wrote:
> Hi!
>
>> Concern has been discussed is risk of broken PRNG and predictable
>> session ID. We may insist any platform must have reliable PRNG, but it
>> would be good idea to have least mitigation. Reading extra bytes
>> should be good enough for this purpose.
>
> I still see no reason to change it stated in the RFC except performance
> (which is irrelevant in all contexts I know of). It states the change
> but omits the reason why this change is necessary. Could you please add
> that part?

Same here.

I have to ask again what prevents you to write your own custom session
module and do everything you consider as safe in there. But this kind
of changes sounds not very helpful and not really done for valid
reasons (for that one). I fully understand the goal to secure (and
this is a very open definition) session manage for php but this cannot
be done in step by step basis.

Cheers,
-- 
Pierre

@pierrejoye | http://www.libgd.org