Re: Randomness Attacks Against PHP Applications

[Raphael Geissert <geissert () debian org>]

On Sunday 23 September 2012 00:14:47 Solar Designer wrote:
> > I agree too that education is important. This is something that we
> > came to an agreement with the PHP team (for example that additional
> > information is needed on the mt_rand manual). However, as pointed out
> > nothing has changed yet (the conversations between us and the PHP team
> > took place in March/April).
>
> Did PHP 5.4's change of session IDs (vs. 5.3's) occur before or after
> your conversations with them?

If you are referring to using /dev/urandom for entropy by default, it was 
changed because of:
https://bugs.php.net/bug.php?id=51436

in 2010.

Regards,
-- 
Raphael Geissert - Debian Developer
www.debian.org - get.debian.net