Everything

php

[RFC][VOTE] Session ID without hashing - Vote reopened and restarted

php.internals

Yasuo Ohgaki

10 years ago

Hi all,

Due to defects in the RFC, vote is reopened and restarted.
Followings are changes from 1st vote.

- Removed session.use_strict_mode change
(Changed when vote reopened)
- Added INI default vote options, incompatible and compatible.
(Changed when 2nd vote is restarted)
- Extended vote period for 2 days.

These who are voted already have to **VOTE AGAIN**.
Sorry for the inconvenience and confusion!

============

Currently session module uses obsolete MD5 for session ID. With
CSPRNG, hashing is redundant and needless. It adds hash module
dependency and inefficient.

This proposal cleans up session code by removing hash.

https://wiki.php.net/rfc/session-id-without-hashing

I set vote requires 2/3 support.
Please describe the reason why when you against this RFC. Reasons are
important for improvements!

Vote ends 2016/08/02 23:59:59 UTC.

Thank you for voting!

--
Yasuo Ohgaki
yohgaki@ohgaki.net

Yasuo Ohgaki

10 years ago

Hi all,

Session ID without hashing
https://wiki.php.net/rfc/session-id-without-hashing#vote

This RFC is passed 9 vs 0.
Compatible default is used as default. 7 vs 3.

It needs to update the default INI. I'll finish it in a few days.

Thank you for voting!

--
Yasuo Ohgaki
yohgaki@ohgaki.net


On Mon, Jul 25, 2016 at 6:49 PM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:

Davey

10 years ago

Hey Yasuo,

Unfortunately this missed beta2 (tagged yesterday), I'll confirm with Joe
about putting it in for 7.1beta3.

Thanks for those last minute changes, I'm much happier with this result! :)

- Davey

On Tue, Aug 2, 2016 at 10:29 PM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:

Yasuo Ohgaki

10 years ago

Hi all and Davey,

On Wed, Aug 3, 2016 at 4:36 PM, Davey Shafik <davey@php.net> wrote:

>
> Unfortunately this missed beta2 (tagged yesterday), I'll confirm with Joe
> about putting it in for 7.1beta3.
>
> Thanks for those last minute changes, I'm much happier with this result! :)

I just realized, php.ini-development/production uses

session.hash_func=0
session.hash_bits_per_character=5 (Compiled default is 4)

The session ID will be ^[0-9a-v]{26}$ (length=26 chars)

So I'll modify php.ini-* default to
session.sid_length=26
session.sid_bit_per_character=5

This matches the current default session ID format used widely. Sorry
for the confusions, but compatible should mean compatible with current
default.

Regards,

P.S. Davery, should I push the patch to 7.1 and master branch, or you will?
I don't mind pasting the patch for 7.1 branch to gist.

--
Yasuo Ohgaki
yohgaki@ohgaki.net

Christoph Becker

10 years ago

Hi Yasuo!

On 25.07.2016 at 11:49, Yasuo Ohgaki wrote:

> Due to defects in the RFC, vote is reopened and restarted.
> Followings are changes from 1st vote.
>
> […]
>
> Vote ends 2016/08/02 23:59:59 UTC.

I've just noticed that the voting is still open, although it's already
2016-08-08.  Shouldn't it be closed?

--
Christoph M. Becker

Yasuo Ohgaki

10 years ago

Hi Christoph,

On Tue, Aug 9, 2016 at 12:44 AM, Christoph M. Becker <cmbecker69@gmx.de> wrote:

>
> I've just noticed that the voting is still open, although it's already
> 2016-08-08.  Shouldn't it be closed?

Thank you!
Closed.

--
Yasuo Ohgaki
yohgaki@ohgaki.net