Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:94448
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmx.de designates 212.227.15.19 as permitted sender)
To: Pierre Joye <pierre.php@gmail.com>, Leigh <leight@gmail.com>
References: <CAPwsocEihGOWC5_KX_FFe36dKTdSob0FFJUKuQW+u53QyeqgsQ@mail.gmail.com>
 <CAEZPtU7AzLGbFh+=bvJNA+HScLVuKsUuF9iUEhACL6xv7VRZ-w@mail.gmail.com>
 <CAPwsocF0Zty7Kp1FZHYA2h+Y+eJvypj9nt1OPa8fdEZdiqR8vw@mail.gmail.com>
 <CAEZPtU48mLGqVVh4sDguto4Vx9Kj+ec=ViTUWXOr-UXCgSt2KA@mail.gmail.com>
 <CAEZPtU6XUGM4BfQ5g+huV_=rrVPfFtpmSO+3CzTcXPC20+x2=g@mail.gmail.com>
 <CAPwsocE5v7mGt3frjoPeFyt6sWtvkjWb=zcPUhFuRLA8fXLY2g@mail.gmail.com>
 <CAEZPtU7e2rvvHtNb3mC3qNT7ZY6djFX3sJ-Wo7rQLDDiRw5Y=w@mail.gmail.com>
Cc: PHP internals <internals@lists.php.net>
Message-ID: <adb07255-3d37-0ca5-b9e7-0efd27b25d7a@gmx.de>
Date: Sat, 9 Jul 2016 11:24:55 +0200
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101
 Thunderbird/45.2.0
MIME-Version: 1.0
In-Reply-To: <CAEZPtU7e2rvvHtNb3mC3qNT7ZY6djFX3sJ-Wo7rQLDDiRw5Y=w@mail.gmail.com>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] [RFC][VOTE] RNG fixes
From: cmbecker69@gmx.de (Christoph Becker)

On 09.07.2016 at 10:49, Pierre Joye wrote:

> On Jul 9, 2016 3:19 PM, "Leigh" <leight@gmail.com> wrote:
>>
>> On Sat, 9 Jul 2016 at 08:48 Pierre Joye <pierre.php@gmail.com> wrote:
>>>
>>> So, I voted no then as it is clear that you do not see a problem to
>>> break codes without a single warning or time to adapt before.
>>>
>>> The other sections are fine and voted yes.
>>
>> For the part where you voted no. Still nobody has presented (publicly
>> available) source that makes legitimate use of mt_srand (yes it's mt_srand
>> that is "broken" here, not mt_rand) for deterministic streams of random
>> numbers. I can only assume by this that almost nobody does. However, for
>> those that do, they can still use the old algorithm.
> 
> I am sorry but this PR possibly breaks BC and cases have been clearly
> explained how and why. Asking to show production  code publically is not
> something that you should request.

ACK.  However, it appears to me that it has not been sufficiently
verified that the random distribution of the current mt_rand()
implementation is as good as the original algorithm (apparently, there
are only some demos and quick investigations available).  Therefore
fixing this in a minor version with the option to enforce the old
behavior looks good to me.

-- 
Christoph M. Becker