# Subverting OpenSSL library function with Windows alternatives

- Thread: https://externals.io/message/54092
- Original archive: https://news-web.php.net/php.internals/54092
- Started by Scott MacVicar on 2011-07-19T22:35:34+00:00
- Messages: 3
- Reply by email to internals@lists.php.net
- More for agents: search with https://externals.io/search.md?q={query} · JSON API at https://externals.io/api · documentation at https://externals.io/llms.txt

---

## #54092 — Scott MacVicar — 2011-07-19T22:35:34+00:00

URL: https://externals.io/message/54092#54092

Just noticed a commit from Pierre last week http://svn.php.net/viewvc?view=revision&revision=313112 which changed OpenSSL to use a special Windows API call for gathering random data.

I've reverted this change so we can discuss this further.

I disagree with advertising a library function and changing it to use something else. Especially when this is around random data / encryption. The OpenSSL library has been audited externally, if there is a better alternative then this patch should go upstream rather than being hacked into PHP.

If we want to offer this as win32_random_data() then I'm also fine with that.

- Scott

---

## #54094 — Pierre Joye — 2011-07-19T22:54:35+00:00

URL: https://externals.io/message/54092#54094 · In reply to: #54092

Scott,




> Just noticed a commit from Pierre last week http://svn.php.net/viewvc?view=revision&revision=313112 which changed OpenSSL to use a special Windows API call for gathering random data.
>
> I've reverted this change so we can discuss this further.

There is nothing to discuss. The Windows implementation is just as
safe and is much faster than the OpenSsl API.

> I disagree with advertising a library function and changing it to use something else. Especially when this is around random data / encryption. The OpenSSL library has been audited externally, if there is a better alternative then this patch should go upstream rather than being hacked into PHP.

I disagreed with the initial implementation of this function in the
1st place, for many reasons that we discussed back then. But you still
applied it. Now I don't want to have windows applications behind yet
again slower because of that and this change greatly improve this
function. So we keep it.


Cheers,
-- 
Pierre

@pierrejoye | http://blog.thepimp.net | http://www.libgd.org

---

## #54095 — Pierre Joye — 2011-07-19T22:56:42+00:00

URL: https://externals.io/message/54092#54095 · In reply to: #54094

and I will restore it myself right now, to be sure that it will be in
the next releases.


> Scott,
>
>
>
> 
> > […]
>
> There is nothing to discuss. The Windows implementation is just as
> safe and is much faster than the OpenSsl API.
>
> > […]
>
> I disagreed with the initial implementation of this function in the
> 1st place, for many reasons that we discussed back then. But you still
> applied it. Now I don't want to have windows applications behind yet
> again slower because of that and this change greatly improve this
> function. So we keep it.
>
>
> Cheers,
> --
> Pierre
>
> @pierrejoye | http://blog.thepimp.net | http://www.libgd.org
>



-- 
Pierre

@pierrejoye | http://blog.thepimp.net | http://www.libgd.org