Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:96426
Return-Path: <yohgaki@ohgaki.net>
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Delivered-To: mailing list internals@lists.php.net
Received: (qmail 11143 invoked from network); 18 Oct 2016 11:38:52 -0000
Received: from unknown (HELO lists.php.net) (127.0.0.1)
  by localhost with SMTP; 18 Oct 2016 11:38:52 -0000
Authentication-Results: pb1.pair.com header.from=yohgaki@ohgaki.net; sender-id=pass
Authentication-Results: pb1.pair.com smtp.mail=yohgaki@ohgaki.net; spf=pass; sender-id=pass
Received-SPF: pass (pb1.pair.com: domain ohgaki.net designates 180.42.98.130 as permitted sender)
X-PHP-List-Original-Sender: yohgaki@ohgaki.net
X-Host-Fingerprint: 180.42.98.130 ns1.es-i.jp  
Received: from [180.42.98.130] ([180.42.98.130:40585] helo=es-i.jp)
	by pb1.pair.com (ecelerity 2.1.1.9-wez r(12769M)) with ESMTP
	id B6/9B-40890-AC906085 for <internals@lists.php.net>; Tue, 18 Oct 2016 07:38:52 -0400
Received: (qmail 85636 invoked by uid 89); 18 Oct 2016 11:38:46 -0000
Received: from unknown (HELO mail-qt0-f180.google.com) (yohgaki@ohgaki.net@209.85.216.180)
  by 0 with ESMTPA; 18 Oct 2016 11:38:46 -0000
Received: by mail-qt0-f180.google.com with SMTP id q7so151680740qtq.1
        for <internals@lists.php.net>; Tue, 18 Oct 2016 04:38:46 -0700 (PDT)
X-Gm-Message-State: AA6/9Rmf+gZNfmyDEEOEfCKUamy9PxaR+zUjUKNMTl9A7r7Zx5SHaAxAgxL2vJiijEj896KqaZ1a4ZSnRm07yQ==
X-Received: by 10.237.56.34 with SMTP id j31mr1959797qte.16.1476790720410;
 Tue, 18 Oct 2016 04:38:40 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.140.84.168 with HTTP; Tue, 18 Oct 2016 04:37:59 -0700 (PDT)
In-Reply-To: <26f72884-49ed-5b1e-1860-3d477f7d9be0@lsces.co.uk>
References: <CAGa2bXYg1kkoYGQNr8T2oTshuqrvweefYO+EdY41w1vwUM32iQ@mail.gmail.com>
 <CAPwsocHhsm9Zrh=rpF=Pbct6t5wKfAa-wirGfGjmxV8pi4nttw@mail.gmail.com>
 <CAGa2bXaMMaZn1GyrnT6Bgz3xCMDkFs+YNwHoNZe_1ge5LjLPDg@mail.gmail.com>
 <CAPwsocHXhpQNCYXVN0DHj77M0cA3eAgKuStOPquNUjx=46W1Mw@mail.gmail.com>
 <CAGa2bXaEyd+Qcc7EAQwTEVJY-zD_cK37AYXfM_534YesBG0xOA@mail.gmail.com>
 <CAPwsocHqbeYw=2S6EZG+5zUEWMSM5V2OoG9uLO05sbQffJ1GPw@mail.gmail.com>
 <CAGa2bXZGWFW1gXx4uuAehw0MGADWPMXVuD7wsSJuAQ6f6HJv6A@mail.gmail.com>
 <CAGa2bXZ1wGO_x4z5agJ0+uWX4xfuOYX1or4KziwbMa9v_+-JxA@mail.gmail.com>
 <CANUQDCh9RSnOs__c4crYsH44z0L-mHkTTCgAn-d1bSgH09yL0w@mail.gmail.com>
 <CAGa2bXbDR4EnSU0UUMQR4OGaEAJGPkf7s9M+56CyCPvJ=XSbUQ@mail.gmail.com>
 <CANUQDChPsJHZ73=ke_yo+Pbu2B8rRcFrUYZWJiD5TrwECY4hEA@mail.gmail.com>
 <CAGa2bXZ98ZKER2hRp=2pvTYGVLGXFzkdefFfoERojgQvarHUBw@mail.gmail.com>
 <52a34722-ccd4-b875-2c1b-f704117ef708@lsces.co.uk> <CANUQDCiM7E8beona_M6nDiGNfT53Fg_rZwgozuEycw629aNNSQ@mail.gmail.com>
 <26f72884-49ed-5b1e-1860-3d477f7d9be0@lsces.co.uk>
Date: Tue, 18 Oct 2016 20:37:59 +0900
X-Gmail-Original-Message-ID: <CAGa2bXZS3oOCNPkDJyZLjbzPJ=jA6+YE347B69S4fH6f5fvs=w@mail.gmail.com>
Message-ID: <CAGa2bXZS3oOCNPkDJyZLjbzPJ=jA6+YE347B69S4fH6f5fvs=w@mail.gmail.com>
To: Lester Caine <lester@lsces.co.uk>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] Re: [RFC][DISCUSSION] Improve uniqid() uniqueness
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

On Tue, Oct 18, 2016 at 8:00 PM, Lester Caine <lester@lsces.co.uk> wrote:
> On 18/10/16 11:02, Niklas Keller wrote:
>>> 'Suppliers' should perhaps be helped to configure their systems so the
>>> > users can use things, but things like /dev/urandom may need some
>>> > additional notes to help identify problems when frameworks like owncloud
>>> > start throwing errors. As Niklas says it's shared environments where
>>> > this one may bite.
>>> >
>> Just to be clear: I don't argue that those systems are broken, I just say
>> that there is a BC break for those systems and that this has to be
>> documented.
>
> Yes ... and the RFC process is at least part of the documentation.

The patch committed is pure bug fix.

uniqid() is simply _broken_ because it does not provide expected uniqueness due
to timestamp based php_combined_lcg(). (I added large warning to the manual
recently, though)

unique id (time stamp) + entropy (timestamp based entropy)

Who argue result is reasonably unique?
Who don't use NTP to adjust system time?

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net