Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:94812
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain daveyshafik.com from 209.85.216.182 cause and error)
MIME-Version: 1.0
Sender: me@daveyshafik.com
In-Reply-To: <CAGa2bXaEYS_ZsoGpp+kXt3WqHYbeSuKdb6XYLvzRhOxQhYPBPg@mail.gmail.com>
References: <CAGa2bXbzdzrG33o=d6dqfK0MQsAd9uuyEiHhHLQ0qo4_MuX_oQ@mail.gmail.com>
 <CAGa2bXaEYS_ZsoGpp+kXt3WqHYbeSuKdb6XYLvzRhOxQhYPBPg@mail.gmail.com>
Date: Wed, 3 Aug 2016 00:36:12 -0700
Message-ID: <CANaX5nfhPF5aQMpthhN1cG00Ka2HrEVm56Ns20Oq8M-W4aqp9A@mail.gmail.com>
To: Yasuo Ohgaki <yohgaki@ohgaki.net>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a11378e1a3e50c5053925e3f4
Subject: Re: [PHP-DEV] Re: [RFC][VOTE] Session ID without hashing - Vote
 reopened and restarted
From: davey@php.net (Davey Shafik)

--001a11378e1a3e50c5053925e3f4
Content-Type: text/plain; charset=UTF-8

Hey Yasuo,

Unfortunately this missed beta2 (tagged yesterday), I'll confirm with Joe
about putting it in for 7.1beta3.

Thanks for those last minute changes, I'm much happier with this result! :)

- Davey

On Tue, Aug 2, 2016 at 10:29 PM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:

> Hi all,
>
> Session ID without hashing
> https://wiki.php.net/rfc/session-id-without-hashing#vote
>
> This RFC is passed 9 vs 0.
> Compatible default is used as default. 7 vs 3.
>
> It needs to update the default INI. I'll finish it in a few days.
>
> Thank you for voting!
> --
> Yasuo Ohgaki
> yohgaki@ohgaki.net
>
>
> On Mon, Jul 25, 2016 at 6:49 PM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
> > Hi all,
> >
> > Due to defects in the RFC, vote is reopened and restarted.
> > Followings are changes from 1st vote.
> >
> >  - Removed session.use_strict_mode change
> >    (Changed when vote reopened)
> >  - Added INI default vote options, incompatible and compatible.
> >    (Changed when 2nd vote is restarted)
> >  - Extended vote period for 2 days.
> >
> > These who are voted already have to **VOTE AGAIN**.
> > Sorry for the inconvenience and confusion!
> >
> > ============
> >
> > Currently session module uses obsolete MD5 for session ID. With
> > CSPRNG, hashing is redundant and needless. It adds hash module
> > dependency and inefficient.
> >
> > This proposal cleans up session code by removing hash.
> >
> > https://wiki.php.net/rfc/session-id-without-hashing
> >
> > I set vote requires 2/3 support.
> > Please describe the reason why when you against this RFC. Reasons are
> > important for improvements!
> >
> > Vote ends 2016/08/02 23:59:59 UTC.
> >
> > Thank you for voting!
> >
> > --
> > Yasuo Ohgaki
> > yohgaki@ohgaki.net
>
> --
> PHP Internals - PHP Runtime Development Mailing List
> To unsubscribe, visit: http://www.php.net/unsub.php
>

--001a11378e1a3e50c5053925e3f4--