Re: [RFC] RNG fixes

On 6/21/2016 9:23 PM, Lester Caine wrote: > Can someone explain why I should need 'crypto safe' random numbers when > ALL *I* use rand for is to give a random order to content items on the > page. Something more in sync with the shuffle and array_rand without the > need to recode to actually use the array functions, or simply select an > entry at random from a list. > There are actually only two properties of an RNG that are of interest to you and that is resource consumption and performance since you do not rely on predictable sequences, a certain amount of randomness, nor portability. mt_rand() provided by PHP is the best choice here right now: rand = https://3v4l.org/nIIdb/perf#tabs mt_rand = https://3v4l.org/Wb3ZA/perf#tabs random_int = https://3v4l.org/5SZHW/perf#tabs But notice how super tiny the difference from random_int() to the others is. Being a use'n'forget for almost all purposes (predictable sequences is the only use case it does not cover). Especially note that random_int() is pretty much as fast as rand() itself! This led me to my initial question: why do we have so many random functions in the first place? Historical? Yes! Needed? -- Richard "Fleshgrinder" Fussenegger

Attachment: [application/pgp-signature] OpenPGP digital signature signature.asc