Re: [RFC] RNG fixes

On 6/21/16 2:32 PM, Stanislav Malyshev wrote:

What is for you "obviously faulty stuff" for literally thousands of people is "code that works". I appreciate that there's a number of new hip randomness tests that mt_rand may not satisfy

As far as I can tell https://gist.github.com/tom--/a12175047578b3ae9ef8 mt_rand() tests just the same as MT19337 and both produce "good quality" random variates. (Btw: there's nothing hip or new about this kind of testing. It's old and boring :p) The issue I have with mt_rand() is speed and memory efficiency, where it is orders of magnitude worse than alternatives. But this won't matter in many uses of mt_rand(). I checked and it doesn't matter in any of the uses in my software. The only argument for removing it that has any legs is: "people use it for security-related unpredictable randoms and PHP should fix that." My judgement is that the real world benefits of doing this don't justify the disruption. Tom