Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:94493
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain daveyshafik.com from 209.85.220.169 cause and error)
MIME-Version: 1.0
Sender: me@daveyshafik.com
In-Reply-To: <alpine.DEB.2.20.1607121124450.16349@whisky.home.derickrethans.nl>
References: <CAGa2bXaSkozJLLtycujwmHyas9TofRw5s6JzG0EQQvPyU0pxNQ@mail.gmail.com>
 <CAGa2bXYLuxq2Yywr_v4B5ExQ37bWE9Fc45KLNCcXVQS3d47_kA@mail.gmail.com> <alpine.DEB.2.20.1607121124450.16349@whisky.home.derickrethans.nl>
Date: Tue, 12 Jul 2016 14:59:09 -0700
Message-ID: <CANaX5ne-nTS8e49-TBa9AtW9YSh3K5Cg6AdZhTBXK=+rgz5cCg@mail.gmail.com>
To: Derick Rethans <derick@php.net>
Cc: Yasuo Ohgaki <yohgaki@ohgaki.net>, "internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a114a8498ee7f320537776027
Subject: Re: [PHP-DEV] Re: [RFC][VOTE] Session ID without hashing
From: davey@php.net (Davey Shafik)

--001a114a8498ee7f320537776027
Content-Type: text/plain; charset=UTF-8

On Tue, Jul 12, 2016 at 3:25 AM, Derick Rethans <derick@php.net> wrote:

> Hi,
>
> The voted-upon-RFC still has
>
> >     session.use_strict_mode (0 to 1) - Changed as insurance of broken
> PRNG implementation.
>
> Although you said:
>
>         It was moved to other RFC.
>
>         https://wiki.php.net/rfc/session-use-strict-mode
>
> And neither did you restart voting after modifying the RFC - or writing
> down in the RFC's changes that it got changed.
>
> So what's the deal?
>

I'd like to see the vote re-run (1 week?) with the changes in place. I
didn't vote because I expected it to be restarted. I would have voted -1 on
the current proposal.

Also, is it possible to add a notice/warning if any of the removed config
settings are set to a non-default value?

We should also have the defaults be the same as for older versions of PHP,
otherwise it's a BC break. That is:

session.sid_length=32
session.sid_bits_per_character=4

Better settings should be documented and in the default ini files, but not
be changed till 8.0 IMO.

I apologize for this feedback being so late.

Thanks,

- Davey

--001a114a8498ee7f320537776027--