A PHP internals discussion about whether `base_convert()` should emit a notice or warning when it silently loses precision due to intermediate floating-point storage. The issue is security-relevant: using `base_convert(bin2hex(random_bytes(16)), 16, 36)` produces a token that appears random but has most of its entropy zeroed out. Participants debate whether a warning is appropriate, and whether switching the implementation to use bcmath for arbitrary precision would be better — though that raises backwards compatibility concerns since some code may rely on the current lossy behavior.
70 Impressions