Re: Subverting OpenSSL library function with Windows alternatives

and I will restore it myself right now, to be sure that it will be in the next releases. On Wed, Jul 20, 2011 at 12:54 AM, Pierre Joye <pierre.php@gmail.com> wrote: > Scott, > > > > On Wed, Jul 20, 2011 at 12:35 AM, Scott MacVicar <scott@macvicar.net> wrote: >> Just noticed a commit from Pierre last week >> http://svn.php.net/viewvc?view=revision&revision=313112 which >> changed OpenSSL to use a special Windows API call for gathering random data. >> >> I've reverted this change so we can discuss this further. > > There is nothing to discuss. The Windows implementation is just as > safe and is much faster than the OpenSsl API. > >> I disagree with advertising a library function and changing it to use something else. >> Especially when this is around random data / encryption. The OpenSSL library has been audited >> externally, if there is a better alternative then this patch should go upstream rather than being >> hacked into PHP. > > I disagreed with the initial implementation of this function in the > 1st place, for many reasons that we discussed back then. But you still > applied it. Now I don't want to have windows applications behind yet > again slower because of that and this change greatly improve this > function. So we keep it. > > > Cheers, > -- > Pierre > > @pierrejoye | http://blog.thepimp.net | > http://www.libgd.org > -- Pierre @pierrejoye | http://blog.thepimp.net | http://www.libgd.org