Re: [PHP-DEV] [RFC][VOTE] Session ID without hashing - Reopened

2016-07-25 Thread Yasuo Ohgaki
Hi Davey, On Mon, Jul 25, 2016 at 6:35 PM, Davey Shafik wrote: > Looks good to me, go for it :) Done. Thank you for helping! -- Yasuo Ohgaki yohg...@ohgaki.net -- PHP Internals - PHP Runtime Development Mailing List To unsubscribe, visit: http://www.php.net/unsub.php

Re: [PHP-DEV] [RFC][VOTE] Session ID without hashing - Reopened

2016-07-25 Thread Davey Shafik
Looks good to me, go for it :) Thanks, - Davey On Mon, Jul 25, 2016 at 2:14 AM, Yasuo Ohgaki wrote: > Hi Davey, > > On Mon, Jul 25, 2016 at 5:46 PM, Yasuo Ohgaki wrote: > > > > On Mon, Jul 25, 2016 at 4:09 PM, Davey Shafik wrote: > >> My suggestion: > >> > >> Re-start the vote, three options

Re: [PHP-DEV] [RFC][VOTE] Session ID without hashing - Reopened

2016-07-25 Thread Yasuo Ohgaki
Hi Davey, On Mon, Jul 25, 2016 at 5:46 PM, Yasuo Ohgaki wrote: > > On Mon, Jul 25, 2016 at 4:09 PM, Davey Shafik wrote: >> My suggestion: >> >> Re-start the vote, three options: >> >> Yes, new defaults (BC Break), Yes, old defaults (no BC break), No >> >> OR: >> >> add a second vote to the page,

Re: [PHP-DEV] [RFC][VOTE] Session ID without hashing - Reopened

2016-07-25 Thread Yasuo Ohgaki
Hi Davey, On Mon, Jul 25, 2016 at 4:09 PM, Davey Shafik wrote: > My suggestion: > > Re-start the vote, three options: > > Yes, new defaults (BC Break), Yes, old defaults (no BC break), No > > OR: > > add a second vote to the page, with: > > Use new defaults (BC Break), Use Old Defaults (No BC Bre

Re: [PHP-DEV] [RFC][VOTE] Session ID without hashing - Reopened

2016-07-25 Thread Davey Shafik
My suggestion: Re-start the vote, three options: Yes, new defaults (BC Break), Yes, old defaults (no BC break), No OR: add a second vote to the page, with: Use new defaults (BC Break), Use Old Defaults (No BC Break) On Sun, Jul 24, 2016 at 6:52 PM, Yasuo Ohgaki wrote: > Hi all, > > I would

Re: [PHP-DEV] [RFC][VOTE] Session ID without hashing - Reopened

2016-07-24 Thread Yasuo Ohgaki
Hi all, I would like to ask the default session ID string preference. Details of guessing an active session ID is described in previous mail. Please refer it for details. On Sun, Jul 24, 2016 at 4:57 PM, Yasuo Ohgaki wrote: > I don't mind pausing vote to have consensus on how many bits for > se

Re: [PHP-DEV] [RFC][VOTE] Session ID without hashing - Reopened

2016-07-24 Thread Yasuo Ohgaki
Hi Davey, On Sun, Jul 24, 2016 at 3:33 PM, Davey Shafik wrote: > Just wanted to let you know I voted no because of the BC breaking change to > the INI options that could easily break many custom session handlers — any > session handler that stores the sessions in a fixed-width column will be > br

Re: [PHP-DEV] [RFC][VOTE] Session ID without hashing - Reopened

2016-07-23 Thread Davey Shafik
Just wanted to let you know I voted no because of the BC breaking change to the INI options that could easily break many custom session handlers — any session handler that stores the sessions in a fixed-width column will be broken. I'm fine changing the defaults in the php.ini-*, but not changing

Re: [PHP-DEV] [RFC][VOTE] Session ID without hashing - Reopened

2016-07-23 Thread Davey Shafik
Done, I guess it just needed a unique name, removing the first one kept the new one only :) - Davey On Sat, Jul 23, 2016 at 10:50 PM, Yasuo Ohgaki wrote: > Hi Davey, > > On Sun, Jul 24, 2016 at 2:37 PM, Davey Shafik wrote: > > > > It didn't actually reopen, and just setting closed to false, it

Re: [PHP-DEV] [RFC][VOTE] Session ID without hashing - Reopened

2016-07-23 Thread Yasuo Ohgaki
Hi Davey, On Sun, Jul 24, 2016 at 2:37 PM, Davey Shafik wrote: > > It didn't actually reopen, and just setting closed to false, it kept the > original votes. So I added a second vote below. Bonus: the original is also > preserved. > > Hope that's OK. Oops, I thought flip-flopped the switch. Than

Re: [PHP-DEV] [RFC][VOTE] Session ID without hashing - Reopened

2016-07-23 Thread Davey Shafik
Yasuo, It didn't actually reopen, and just setting closed to false, it kept the original votes. So I added a second vote below. Bonus: the original is also preserved. Hope that's OK. - Davey On Sat, Jul 23, 2016 at 9:50 PM, Yasuo Ohgaki wrote: > Hi all, > > Due to a defect in the RFC, vote is

[PHP-DEV] [RFC][VOTE] Session ID without hashing - Reopened

2016-07-23 Thread Yasuo Ohgaki
Hi all, Due to a defect in the RFC, vote is reopened for a week. Removed lines are indicated by . No additional lines nor modifications other than removed lines for session.use_strict_mode change. Sorry for the confusion! Currently session module uses obsolete MD5 for session ID. Wi