Re: [RFC] RNG fixes

Updated RFC * Removed proposal to replace (mt_)rand with an alternative algorithm as many have expressed concerns with this. * Clarified that the output of mt_rand _appears_ to be high quality as-is * Added that the old mt_rand functionality will be available at runtime via mt_rand_mode() I'll have an implementation ready for review by the end of the week. On 16 June 2016 at 19:54, Leigh <leight@gmail.com> wrote: > RFC updated to include: > * A note about mt_rand()s poor performance > * Separate votes for proposals so we can at least get the security fixes > through > * Updated vote from 50% to 2/3 as it does cause a BC issue. > > I should also state that mt_rand is easily implementable in userland, so the > correct/legacy algorithm can be provided that way if changing it in core > does not pass (I have a library providing this) > > So there have been a couple of suggestions of providing legacy functionality > via a PECL extension. If we were to make rand/mt_rand use function pointers > to their implementation it would be very easy for an extension to override > their behaviour. If people like this idea I'm more than happy to provide > this ext as part of the RFC.