Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:96206
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.213.53 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAGa2bXZVteMu8xU80CTWQ5F1VxZUahXmz2OZDwmJbePd9sqp9Q@mail.gmail.com>
References: <CAGa2bXYg1kkoYGQNr8T2oTshuqrvweefYO+EdY41w1vwUM32iQ@mail.gmail.com>
 <CAGa2bXZLB6SsC3FQyntaDy93YfG5rDigJH6GpC5dF7MZJuJ=LQ@mail.gmail.com>
 <CAGa2bXaM_rSbmSx_bPE4erG6ok1KLdXSqnJP5ngxUNBsrzu0pw@mail.gmail.com>
 <CANaX5ne-j3=DvOhXF4OHt00cT2tMSGGEM-6hR45uO6EHrA=r-Q@mail.gmail.com> <CAGa2bXZVteMu8xU80CTWQ5F1VxZUahXmz2OZDwmJbePd9sqp9Q@mail.gmail.com>
Date: Tue, 4 Oct 2016 12:55:00 +0700
Message-ID: <CAEZPtU6BJaLr8dBZbzY829ePRRQYcCPr_3OMccwJ2uiuHhyOWA@mail.gmail.com>
To: Yasuo Ohgaki <yohgaki@ohgaki.net>
Cc: Davey Shafik <davey@php.net>, PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a114dcc54a3da6b053e03b3ef
Subject: Re: [PHP-DEV] [RFC][DISCUSSION] Improve uniqid() uniqueness
From: pierre.php@gmail.com (Pierre Joye)

--001a114dcc54a3da6b053e03b3ef
Content-Type: text/plain; charset=UTF-8

On Oct 4, 2016 8:55 AM, "Yasuo Ohgaki" <yohgaki@ohgaki.net> wrote:
>
> Hi Davey,
>
> On Tue, Oct 4, 2016 at 4:59 AM, Davey Shafik <davey@php.net> wrote:
> > On Sunday, October 2, 2016, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
> >>
> >> Hi all,
> >>
> >> On Mon, Oct 3, 2016 at 3:56 AM, Yasuo Ohgaki <yohgaki@ohgaki.net>
wrote:
> >> > Besides improving "more entropy" the default and data, I prepared
> >> > fully compatible patch to simplify discussion.
> >> >
> >> > https://gist.github.com/anonymous/fb615df325d559fa806a265031a06ede
> >> >
> >> > I would like to apply this patch from PHP 7.0 branch, then discuss
what
> >> > the default should be.
> >> >
> >> > Any comments?
> >> > If there is no objections, I'll apply this few days later.
> >
> >
> > Yasuo,
> >
> > This change should go through the standard RFC process and should be
> > targeted at 7.2+ (master) *only*.
> >
> > Please check with the RMs before merging functionality changes into
release
> > branches. All functionality changes need consent and consensus. Bug
fixes
> > (that don't change functionality or break BC) do not.
> >
> > I understand your desire to fix these things, especially the security
> > related type stuff, but as a group we have a responsibility to create
> > predictable, sane, and safe (as in, don't break stuff) migration paths
when
> > we can. A history of doing this is WHY php is still going strong after
so
> > long.
> >
> > Thanks,
>
> I agree fully.
>
> The only case this patch could break code is caused by broken PRNG in
> the system which is fatal anyway. i.e. If PRNG is broken, session
> module/randon_*() cannot produce secure session ID/values. We don't
> have to worry about changed behavior/BC.
>
> The main motivation is to simply this RFC discussion. I'll commit this
> patch master only.

Did you solve any of the issues we discussed here? Some of them are BC
breaks.

Thanks
Pierre

--001a114dcc54a3da6b053e03b3ef--