Re: [VOTE] Secure Session Module Options/Internal by Default

Hi Zeev, On Tue, Feb 18, 2014 at 8:46 PM, Zeev Suraski <zeev@zend.com> wrote: > This was previously discussed but I have to agree with Andrey (and maybe > even go beyond what he said) - the hash_bits change doesn't belong in this > RFC. First, it has no security implications and it's not entirely clear > from the RFC. Second, I don't feel that the implications of that change > are > clear, beyond some mention that "this could not be an issue for almost all > apps", which personally I don't think is accurate - but either way, we need > some better analysis here. > > From my point of view I don't think a few extra characters per session > going > over the wire are worth the potential obscure BC break changing the default > here will cause with certain session backends and/or apps, and we shouldn't > include this change in this RFC. If we want to compact the session id's, > proposing a change for this default can be done in a separate RFC that > discusses the pros and cons of doing it, independent of security. > I agree. This would be removed. This means vote is closed and reopened again. I'm not sure why compiled and php.ini-* default differs now, but it's irrelevant issue here anyway. Another thing that I think this RFC is missing is some clearer explanation > on what kind of apps *don't* work with the proposed changes (most notably > use_strict_mode=on and cookie_httponly). Even though my gut is that these > two proposed changes are good - the RFC should include explanations of the > code patterns and/or types of apps and/or modules that will be affected by > this; "Most apps should not be affected" isn't enough in an RFC IMHO. > I'll add explanations and possible side effects. I think of few. > Last - the voting period should be at least a week, right now it's 5 (or > maybe 6, depending on your POV) days. > This is mistake. My apologies. Thank you for your comment. Regards, -- Yasuo Ohgaki yohgaki@ohgaki.net