[PHP-DEV] Re: [RFC] RNG fixes

2016-06-30 Thread Leigh
Updated RFC * Removed proposal to replace (mt_)rand with an alternative algorithm as many have expressed concerns with this. * Clarified that the output of mt_rand _appears_ to be high quality as-is * Added that the old mt_rand functionality will be available at runtime via `mt_rand_mode()` I'll

[PHP-DEV] Re: [RFC] RNG fixes

2016-06-16 Thread Tom Worster
Hi Leigh, I need to change stance wrt MT. On 6/16/16, 2:31 PM, "Leigh" wrote: >I get your point, but most people probably use mt_rand() because "it's >better than rand". mt_rand is also incredibly slow and has a huge state >when compared to modern algorithms. I should probably note the >perfor

[PHP-DEV] Re: [RFC] RNG fixes

2016-06-16 Thread Leigh
RFC updated to include: * A note about mt_rand()s poor performance * Separate votes for proposals so we can at least get the security fixes through * Updated vote from 50% to 2/3 as it does cause a BC issue. I should also state that mt_rand is easily implementable in userland, so the correct/legac

[PHP-DEV] Re: [RFC] RNG fixes

2016-06-16 Thread Leigh
On Wed, 15 Jun 2016 at 00:08 Tom Worster wrote: > On 6/14/16 12:46 PM, Leigh wrote: > > > The RFC can be found here: https://wiki.php.net/rfc/rng_fixes > > Hi Leigh, > > Thanks for putting this together. I am strongly pro on two points and > moderately contra on the other two. I'd prefer separate

[PHP-DEV] Re: [RFC] RNG fixes

2016-06-15 Thread Christoph Becker
On 15.06.2016 at 01:08, Tom Worster wrote: > On 6/14/16 12:46 PM, Leigh wrote: > >> The RFC can be found here: https://wiki.php.net/rfc/rng_fixes > > Thanks for putting this together. I am strongly pro on two points and > moderately contra on the other two. I'd prefer separated votes, even > tho

[PHP-DEV] Re: [RFC] RNG fixes

2016-06-14 Thread Tom Worster
On 6/14/16 12:46 PM, Leigh wrote: The RFC can be found here: https://wiki.php.net/rfc/rng_fixes Hi Leigh, Thanks for putting this together. I am strongly pro on two points and moderately contra on the other two. I'd prefer separated votes, even though I don't have a vote. I numbered the 4 b