Re: [PHP-DEV] Password_hash salt generation refactor

2015-10-19 Thread Ángel González
On 19/10/15 21:43, Scott Arciszewski wrote: (...) If you have a keyspace of 2^32 possible output sequences like we do from rand(), we can say that after 65,536 there is a 50% probability of finding at least one collision. It should go without saying, but if users have weak/common password choic

Re: [PHP-DEV] Password_hash salt generation refactor

2015-10-19 Thread Tom Worster
On 10/19/15 3:43 PM, Scott Arciszewski wrote: On Mon, Oct 19, 2015 at 1:00 PM, Chris Riley wrote: On 19 October 2015 at 16:22, Tom Worster wrote: On 10/18/15 7:39 PM, Ángel González wrote: Korvin wrote: +1 for 7.0.x security patch release, best effort sounds scary. This is a salt. It d

Re: [PHP-DEV] Password_hash salt generation refactor

2015-10-19 Thread Scott Arciszewski
On Mon, Oct 19, 2015 at 1:00 PM, Chris Riley wrote: > On 19 October 2015 at 16:22, Tom Worster wrote: > >> On 10/18/15 7:39 PM, Ángel González wrote: >> >>> Korvin wrote: >>> +1 for 7.0.x security patch release, best effort sounds scary. >>> This is a salt. It doesn't need to be cryptog

Re: [PHP-DEV] Password_hash salt generation refactor

2015-10-19 Thread Chris Riley
On 19 October 2015 at 16:22, Tom Worster wrote: > On 10/18/15 7:39 PM, Ángel González wrote: > >> Korvin wrote: >> >>> +1 for 7.0.x security patch release, best effort sounds scary. >>> >> This is a salt. It doesn't need to be cryptographically secure. Using >> php_rand() >> there should pose no

[PHP-DEV] docs karma

2015-10-19 Thread Dmitry Zenovich
Hi! I want to refresh Runkit's documentation. Please give me access rights to do this. My php.net account is dzenovich. Thanks!

Re: [PHP-DEV] Password_hash salt generation refactor

2015-10-19 Thread Tom Worster
On 10/18/15 7:39 PM, Ángel González wrote: Korvin wrote: +1 for 7.0.x security patch release, best effort sounds scary. This is a salt. It doesn't need to be cryptographically secure. Using php_rand() there should pose no problem. I would actually include that into the patch (move old lines 154

[PHP-DEV] Fwd: Proper VARIANT to use for System.Security.Cryptography.RNGCryptoServiceProvider?

2015-10-19 Thread Scott Arciszewski
Okay, I've tried both wind...@lists.php.net and php.wind...@lists.php.net and I give up trying there. -- Since CAPICOM is deprecated, for users without ext/mcrypt or ext/openssl, I'd like random_compat to work on Windows 7 and later. $rng = new DOTNET( 'mscorlib', 'System

[PHP-DEV] Re: [RFC] Void Return Type (v0.2, reöpening)

2015-10-19 Thread Tom Worster
Hi Andrea, I'm very much in favor of this RFC. It's not just useful, I think void return declarations are needed in order to establish sensible style rules for strict mode in real projects. To be strict in our programming practices, the absence of a return declaration signifies too many thing

Re: [PHP-DEV] [RFC] Void Return Type (v0.2, reöpening)

2015-10-19 Thread Bob Weinand
> Am 19.10.2015 um 11:46 schrieb Derick Rethans : > > On Thu, 15 Oct 2015, Rowan Collins wrote: > >> Korvin Szanto wrote on 14/10/2015 23:55: >>> If I capture the result of a "void" method and check if my result variable >>> with isset(), I'll get false. This sounds like it's void of value to me

[PHP-DEV] Benchmark Results for PHP Master 2015-10-19

2015-10-19 Thread lp_benchmark_robot
Results for project PHP master, build date 2015-10-19 10:08:24+03:00 commit: 620daef1e253dc841f5dcb24976e5378c296e8cd revision date: 2015-10-18 17:20:17-07:00 environment:Haswell-EP cpu:Intel(R) Xeon(R) CPU E5-2699 v3 @ 2.30GHz 2x18 cores, stepping 2, LLC 45 MB mem

Re: [PHP-DEV] Re: Forbid rebinding scope of closures created by ReflectionFunctionAbstract::getClosure()

2015-10-19 Thread Alexander Lisachenko
2015-10-19 12:19 GMT+03:00 Nikita Popov : > This change is primarily targeting userland methods, so your use-case is > exactly the one this is supposed to prevent. Note that you can still use > ->bindTo($object). The only thing you cannot do is ->bindTo($object, > get_class($object)). It's very

Re: [PHP-DEV] [RFC] Void Return Type (v0.2, reöpening)

2015-10-19 Thread Derick Rethans
On Thu, 15 Oct 2015, Rowan Collins wrote: > Korvin Szanto wrote on 14/10/2015 23:55: > > If I capture the result of a "void" method and check if my result variable > > with isset(), I'll get false. This sounds like it's void of value to me. > > But why "invent" (as far as PHP is concerned) this n

Re: [PHP-DEV] Re: Forbid rebinding scope of closures created by ReflectionFunctionAbstract::getClosure()

2015-10-19 Thread Nikita Popov
On Mon, Oct 19, 2015 at 10:18 AM, Alexander Lisachenko < lisachenko...@gmail.com> wrote: > Hello, internals! > > Just noticed this thread and want to clarify some things with getClosure() > method. If i understood correctly, ReflectionFunctionAbstract::getClosure() > should return non-rebindable c

RE: [PHP-DEV] Re: Forbid rebinding scope of closures created by ReflectionFunctionAbstract::getClosure()

2015-10-19 Thread Anatol Belski
Hi Alexander, > -Original Message- > From: Alexander Lisachenko [mailto:lisachenko...@gmail.com] > Sent: Monday, October 19, 2015 10:19 AM > To: Anatol Belski > Cc: Xinchen Hui ; Nikita Popov ; > Dmitry Stogov ; PHP internals > Subject: Re: [PHP-DEV] Re: Forbid rebinding scope of closure

Re: [PHP-DEV] Re: Forbid rebinding scope of closures created by ReflectionFunctionAbstract::getClosure()

2015-10-19 Thread Alexander Lisachenko
Hello, internals! Just noticed this thread and want to clarify some things with getClosure() method. If i understood correctly, ReflectionFunctionAbstract::getClosure() should return non-rebindable closure ONLY for internal functions, but for userland functions binding should be still possible, ri