Re: random token re-used in subsequent requests

2016-05-17 Thread Vincent Veyron
On Tue, 17 May 2016 20:41:28 +0200 demerphq wrote: > > If you fork before you call (s)rand then each child process will have > their own copy of the flag, which will be false, and thus will cause > srand() to be called in the subprocess properly. > So now I'm lost : I understand this as meaning

Re: random token re-used in subsequent requests

2016-05-17 Thread demerphq
On 17 May 2016 at 20:37, André Warnier wrote: > On 17.05.2016 20:26, demerphq wrote: >> >> On 17 May 2016 at 20:23, demerphq wrote: >>> >>> On 16 May 2016 at 20:03, Bruce Johnson >>> wrote: > On May 16, 2016, at 10:15 AM, André Warnier (tomcat) > wrote: > > > join

Re: random token re-used in subsequent requests

2016-05-17 Thread André Warnier
On 17.05.2016 20:26, demerphq wrote: On 17 May 2016 at 20:23, demerphq wrote: On 16 May 2016 at 20:03, Bruce Johnson wrote: On May 16, 2016, at 10:15 AM, André Warnier (tomcat) wrote: join "", map +(0..9,"a".."z","A".."Z")[rand(10+26*2)], 1..32 ; looks at first sight to me like quite i

Re: random token re-used in subsequent requests

2016-05-17 Thread demerphq
On 17 May 2016 at 15:10, André Warnier wrote: > On 17.05.2016 14:11, Vincent Veyron wrote: >> >> On Tue, 17 May 2016 10:16:43 +0200 >> André Warnier wrote: >>> >>> >>> I don't see above any signifiant difference in configuration between the >>> servers, apart >>> from the fact that the "faulty" s

Re: random token re-used in subsequent requests

2016-05-17 Thread demerphq
On 17 May 2016 at 20:23, demerphq wrote: > On 16 May 2016 at 20:03, Bruce Johnson wrote: >> >>> On May 16, 2016, at 10:15 AM, André Warnier (tomcat) >>> wrote: >>> >>> >>> join "", map +(0..9,"a".."z","A".."Z")[rand(10+26*2)], 1..32 ; >>> >>> looks at first sight to me like quite inefficient a

Re: random token re-used in subsequent requests

2016-05-17 Thread demerphq
On 16 May 2016 at 20:03, Bruce Johnson wrote: > >> On May 16, 2016, at 10:15 AM, André Warnier (tomcat) wrote: >> >> >> join "", map +(0..9,"a".."z","A".."Z")[rand(10+26*2)], 1..32 ; >> >> looks at first sight to me like quite inefficient and probably likely to >> generate the same string regul

Re: random token re-used in subsequent requests

2016-05-17 Thread André Warnier
On 17.05.2016 14:11, Vincent Veyron wrote: On Tue, 17 May 2016 10:16:43 +0200 André Warnier wrote: I don't see above any signifiant difference in configuration between the servers, apart from the fact that the "faulty" server runs a 64-bit version of perl. Sorry : slightly digressive rant a

Re: random token re-used in subsequent requests

2016-05-17 Thread Clive Eisen
Your test are on the command line, not inside apache and thus more or less worthless. As André clearly showed the issue is almost certainly with the way srand is being called inside apache Add a call to srand with something suitably random from time pid and maybe /dev/random INSIDE apache bef

Re: random token re-used in subsequent requests

2016-05-17 Thread Vincent Veyron
On Tue, 17 May 2016 10:16:43 +0200 André Warnier wrote: > > I don't see above any signifiant difference in configuration between the > servers, apart > from the fact that the "faulty" server runs a 64-bit version of perl. Sorry : slightly digressive rant about the fact that every time I compar

Re: random token re-used in subsequent requests

2016-05-17 Thread André Warnier
On 17.05.2016 08:28, Vincent Veyron wrote: On Mon, 16 May 2016 22:45:14 + "Bruce Johnson" wrote: I don’t think it would be likely for Vincent to ever see this once, let alone have it rise to the issue of a problem if it were strictly about non-randomness of the rand() function. Inde