Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:98127
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain ohgaki.net designates 180.42.98.130 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <842237fd-7e2d-70b4-5e0b-754bcba1fcf8@gmx.de>
References: <0D26A03B-6BEB-4730-8E4B-0F7D6835E683@thefsb.org>
 <CAGa2bXZYStrud9MWya-680Z457T1i-a2F5u-AXtaNvkTdMEZtQ@mail.gmail.com>
 <CAGa2bXZRT2xGgL7fMkHFetjDk00w=AMmaCipVeM5Oftvd0mYAw@mail.gmail.com>
 <8991137d8dd8ba915bcacd4fbc1fe88f@gmail.com> <CAGa2bXYBV8cUBDXf5j2ZG6wDxDtTG1389JKNWJNi8-YT5FHupQ@mail.gmail.com>
 <CAGa2bXYw70SzxpicASH-Go5XPy4FJb2gnyuoJuYm=f3+dzB52A@mail.gmail.com>
 <CAGa2bXa97GVG-FxB-NDm4rVTKC+w8hUwFi-v0Kann_F_rEKKxA@mail.gmail.com>
 <1fa97f9f4d4c0866fb4b0f21fc68b068@gmail.com> <CAGa2bXakeme3h6RgqYWtJ+usJ6YwjJf7LkHaj=yVQXHWkdx+6w@mail.gmail.com>
 <842237fd-7e2d-70b4-5e0b-754bcba1fcf8@gmx.de>
Date: Fri, 3 Feb 2017 07:56:09 +0900
Message-ID: <CAGa2bXammUs7s7VH+YzD9R1OVNhiOtoBArhRN5o5UUrz0oRi_Q@mail.gmail.com>
To: "Christoph M. Becker" <cmbecker69@gmx.de>
Cc: =?UTF-8?Q?Lauri_Kentt=C3=A4?= <lauri.kentta@gmail.com>, 
	Tom Worster <fsb@thefsb.org>, "internals@lists.php.net" <internals@lists.php.net>, Leigh <leight@gmail.com>, 
	Nikita Popov <nikita.ppv@gmail.com>
Content-Type: multipart/alternative; boundary=001a114a8a5c9867290547941429
Subject: Re: [PHP-DEV] Re: Improving mt_rand() seed
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--001a114a8a5c9867290547941429
Content-Type: text/plain; charset=UTF-8

On Thu, Feb 2, 2017 at 10:24 PM, Christoph M. Becker <cmbecker69@gmx.de>
wrote:

> On 02.02.2017 at 12:51, Yasuo Ohgaki wrote:
>
> > Although users must never do this, but there are codes that generate
> random
> > password/access key by mt_rand().
>
> There is also code that stores clear text passwords.  How would you
> prevent that?
>
> IMHO, if users don't care to read the docs[1], it's their fault, and we
> shouldn't waste our time to fix their bugs.


I totally agree.

However, there are valid usage like

a.php
<?php
// I need static random sequence
srand(1234);
for ($i = 0; $i < 10; $i++)
  $rand[] = rand();
?>

b.php
<?php
// I need random sequence, let PHP seed it
for ($i = 0; $i < 10; $i++)
  $better_rand[] = mt_rand();

// VALID USAGE
// I'm going to randomize which quiz is displayed
?>

This is unacceptable BC in PHP 7.1.

For PHP 7.1, there must be rand() own state at least.
This was discussed in other thread, "Reseeding rand()/mt_rand()".
User and system seed should be separated and independent.

Anyway, which code must be fixed, a.php or b.php in such case?
Suppose you are drupal (or any apps) module developer and using mt_rand()
that
requires random values. Someone else wants to use static random sequence,
which is rare usage compare to plain mt_rand() call w/o user seed, then
suddenly your code became broken. IMO, a.php must be fixed.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net

--001a114a8a5c9867290547941429--