I would like to create two settings to unify the entropy source
accross php functions. That includes mcrypt, new password APIs,
session, LCG, etc.
I'm generally against .ini directives but this sounds like a sensible
approach to me. In the absence of a unified function to handle this the
.ini settings prevent me from having to iterate over the potential names
until I find one that's available.
I am not willing to propose new RNG functions or extensions for 5.6 as
we have way too little time to actually discuss its design and APIs.
However having these settings unified and documented would be a good
step forward already.
I agree. It's too late in the game to rush something like this for 5.6. No
PHP applications have exploded (that I'm aware of) for lack of a unified
entropy function; we should probably discuss the best solution going
forward and get it right for 5.7 ...