Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:96207
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain kelunik.com from 81.169.146.160 cause and error)
MIME-Version: 1.0
References: <CAGa2bXYg1kkoYGQNr8T2oTshuqrvweefYO+EdY41w1vwUM32iQ@mail.gmail.com>
 <CAGa2bXZLB6SsC3FQyntaDy93YfG5rDigJH6GpC5dF7MZJuJ=LQ@mail.gmail.com>
 <CAGa2bXaM_rSbmSx_bPE4erG6ok1KLdXSqnJP5ngxUNBsrzu0pw@mail.gmail.com>
 <CANaX5ne-j3=DvOhXF4OHt00cT2tMSGGEM-6hR45uO6EHrA=r-Q@mail.gmail.com> <CAGa2bXZVteMu8xU80CTWQ5F1VxZUahXmz2OZDwmJbePd9sqp9Q@mail.gmail.com>
In-Reply-To: <CAGa2bXZVteMu8xU80CTWQ5F1VxZUahXmz2OZDwmJbePd9sqp9Q@mail.gmail.com>
Date: Tue, 04 Oct 2016 07:16:43 +0000
Message-ID: <CANUQDCjSmsqKV5DDe=koxVNjWf+R_URF+nFDzFyDcwrueGLBuw@mail.gmail.com>
To: Yasuo Ohgaki <yohgaki@ohgaki.net>, PHP Internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a1145bd82559eaa053e04d8c2
Subject: Re: [PHP-DEV] [RFC][DISCUSSION] Improve uniqid() uniqueness
From: me@kelunik.com (Niklas Keller)

--001a1145bd82559eaa053e04d8c2
Content-Type: text/plain; charset=UTF-8

Yasuo Ohgaki <yohgaki@ohgaki.net> schrieb am Di., 4. Okt. 2016, 03:54:

> Hi Davey,
>
> On Tue, Oct 4, 2016 at 4:59 AM, Davey Shafik <davey@php.net> wrote:
> > On Sunday, October 2, 2016, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
> >>
> >> Hi all,
> >>
> >> On Mon, Oct 3, 2016 at 3:56 AM, Yasuo Ohgaki <yohgaki@ohgaki.net>
> wrote:
> >> > Besides improving "more entropy" the default and data, I prepared
> >> > fully compatible patch to simplify discussion.
> >> >
> >> > https://gist.github.com/anonymous/fb615df325d559fa806a265031a06ede
> >> >
> >> > I would like to apply this patch from PHP 7.0 branch, then discuss
> what
> >> > the default should be.
> >> >
> >> > Any comments?
> >> > If there is no objections, I'll apply this few days later.
> >
> >
> > Yasuo,
> >
> > This change should go through the standard RFC process and should be
> > targeted at 7.2+ (master) *only*.
> >
> > Please check with the RMs before merging functionality changes into
> release
> > branches. All functionality changes need consent and consensus. Bug fixes
> > (that don't change functionality or break BC) do not.
> >
> > I understand your desire to fix these things, especially the security
> > related type stuff, but as a group we have a responsibility to create
> > predictable, sane, and safe (as in, don't break stuff) migration paths
> when
> > we can. A history of doing this is WHY php is still going strong after so
> > long.
> >
> > Thanks,
>
> I agree fully.
>
> The only case this patch could break code is caused by broken PRNG in
> the system which is fatal anyway. i.e. If PRNG is broken, session
> module/randon_*() cannot produce secure session ID/values. We don't
> have to worry about changed behavior/BC.
>
> The main motivation is to simply this RFC discussion. I'll commit this
> patch master only.
>

It still needs a RFC.

Regards, Niklas

Regards,
>
> --
> Yasuo Ohgaki
> yohgaki@ohgaki.net
>
> --
> PHP Internals - PHP Runtime Development Mailing List
> To unsubscribe, visit: http://www.php.net/unsub.php
>
>

--001a1145bd82559eaa053e04d8c2--