Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:121082
MIME-Version: 1.0
References: <e6d0f349-436d-8545-4146-e1293c901d65@bastelstu.be>
 <CAAwdEzD=3cG17jCz8v4dT1qoCMOjxEgqh1UvSwk-MU2nVEMA2A@mail.gmail.com> <076e8c8a-9f17-0163-acad-87df7f4302a1@bastelstu.be>
In-Reply-To: <076e8c8a-9f17-0163-acad-87df7f4302a1@bastelstu.be>
Date: Mon, 18 Sep 2023 05:40:27 +0300
Message-ID: <CAAwdEzAJnOBvqScAfvihtWyov2OZQWp5xHScKHApC=rhoSXiWw@mail.gmail.com>
To: =?UTF-8?Q?Tim_D=C3=BCsterhus?= <tim@bastelstu.be>
Cc: PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="000000000000adfaa7060599113f"
Subject: Re: [PHP-DEV] RFC: Increasing the default BCrypt cost
From: drealecs@gmail.com (=?UTF-8?Q?Alexandru_P=C4=83tr=C4=83nescu?=)

--000000000000adfaa7060599113f
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Sun, Sep 10, 2023 at 7:06=E2=80=AFPM Tim D=C3=BCsterhus <tim@bastelstu.b=
e> wrote:

> Hi
>
> On 9/8/23 18:49, Alexandru P=C4=83tr=C4=83nescu wrote:
> >
> > I think 12 looks reasonable.
> > I've performed some tests myself on private hosted servers with
> > newer hardware with good results for 12 around 0.1 seconds.
>
> wow, that is a 33% reduction even compared to the Xeon E-2246G and thus
> hard to believe. What CPU is that?
>
>
That was a new Xeon Gold 5416S.
I got lucky being able to run some tests on it before being pushed to
production replacing a slightly older one, a Xeon Gold 5218.
I'll be able to test that as well, but I feel like anyway the hardware I
used is not what is usually in general.
Actually, it is even less relevant, as it is meant to be used by a high
performing MySQL server and not for running PHP.


> > Pushing it to 8.4 will delay the real usage with 2-3 more years already=
.
>
> IMO this is fine. Common frameworks can and do already use a different
> default. Symfony apparently is at 13 by default. Laravel uses 10, but
> I've already pinged someone on Mastodon to maybe have a look at the
> results of this RFC:
>
> https://phpc.social/@timwolla/111025125667858110
>
> The current default of 10 is not insecure and rolling this out a little
> more slowly will mean that more and more of the old and slow hardware
> will be retired and replaced by modern hardware, lessening the impact.
>
>
Understood, yes, I agree.


> > I feel like the hardware performance improvements (specifically single
> > thread performance) slightly increased in the past 3-4 years, and soon
> most
> > of the hosting providers will be using it.
> >
>
>  From my experience as a developer of a software that is commonly run on
> shared hosting, web hosters *love* their ancient hardware, because it's
> fully depreciated from a taxation / accounting PoV and every extra day
> it is used is "free money". Customers commonly are not able to tell they
> are running with tens of other customers on this ancient hardware and
> thus won't complain ("loading times of 1 second are fine").
>
>
Yes, I think I evaluated the hardware upgrade lifecycle to be around 5
years, but in reality it's 10-15 years.
And also the CPU options used by hosting providers are cost oriented, to
get the most performance per dollar.

Thank you,
Alex

--000000000000adfaa7060599113f--