Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:94670
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain daveyshafik.com from 209.85.220.182 cause and error)
MIME-Version: 1.0
Sender: me@daveyshafik.com
In-Reply-To: <CAGa2bXZn5HiOD6LsotYDmUJKhGxxpp0xTsMSE2bp5HO0fsCmtA@mail.gmail.com>
References: <CAGa2bXZn5HiOD6LsotYDmUJKhGxxpp0xTsMSE2bp5HO0fsCmtA@mail.gmail.com>
Date: Sat, 23 Jul 2016 23:33:07 -0700
Message-ID: <CANaX5nccP6LBVow1oaO6jzU0PRjaruRSjdhiZ8kb=071gpiUTA@mail.gmail.com>
To: Yasuo Ohgaki <yohgaki@ohgaki.net>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a114d502e43b59005385bd7fd
Subject: Re: [PHP-DEV] [RFC][VOTE] Session ID without hashing - Reopened
From: davey@php.net (Davey Shafik)

--001a114d502e43b59005385bd7fd
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

Just wanted to let you know I voted no because of the BC breaking change to
the INI options that could easily break many custom session handlers =E2=80=
=94 any
session handler that stores the sessions in a fixed-width column will be
broken.

I'm fine changing the defaults in the php.ini-*, but not changing the
defaults in the code. Also, documenting the better values as recommended.

Putting my RM hat on, I'm not comfortable merging this in 7.1 with an
unnecessary BC breaking change. Changing the default is the BC break,
regardless of the _ability_ to change the settings back to the previous
values.



On Sat, Jul 23, 2016 at 9:50 PM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:

> Hi all,
>
> Due to a defect in the RFC, vote is reopened for a week. Removed lines
> are indicated by <del></del>. No additional lines nor modifications
> other than removed lines for session.use_strict_mode change.
> Sorry for the confusion!
>
> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
>
> Currently session module uses obsolete MD5 for session ID. With
> CSPRNG, hashing is redundant and needless. It adds hash module
> dependency and inefficient (There is no reason to use hash for CSPRNG
> generated bytes).
>
> This proposal cleans up session code by removing hash.
>
> https://wiki.php.net/rfc/session-id-without-hashing
>
> I set vote requires 2/3 support.
> Please describe the reason why when you against this RFC. Reasons are
> important for improvements!
>
> Thank you!
>
> --
> Yasuo Ohgaki
> yohgaki@ohgaki.net
>
> --
> PHP Internals - PHP Runtime Development Mailing List
> To unsubscribe, visit: http://www.php.net/unsub.php
>

--001a114d502e43b59005385bd7fd--