Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:121292
Content-Type: text/plain;
	charset=us-ascii
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3731.700.6\))
In-Reply-To: <CAMrTa2H8KGV7gwgoC7hkxrcnYekajSYHb2QerO=QF_o4EwJ5+A@mail.gmail.com>
Date: Fri, 13 Oct 2023 02:26:53 +0100
Cc: steve@tobtu.com,
 =?utf-8?Q?Tim_D=C3=BCsterhus?= <tim@bastelstu.be>,
 PHP internals <internals@lists.php.net>
Content-Transfer-Encoding: quoted-printable
Message-ID: <20DF88DB-68D4-4E15-B2BA-934241BE0ED3@craigfrancis.co.uk>
References: <a9b0d24f-fe59-75af-4b1e-dcd8067482b0@bastelstu.be>
 <263398749.1356563.1696464473187@email.ionos.com>
 <CAMrTa2H8KGV7gwgoC7hkxrcnYekajSYHb2QerO=QF_o4EwJ5+A@mail.gmail.com>
To: Jordan LeDoux <jordan.ledoux@gmail.com>
Subject: Re: [PHP-DEV] [VOTE] Increasing the default BCrypt cost
From: craig@craigfrancis.co.uk (Craig Francis)

On 12 Oct 2023, at 19:50, Jordan LeDoux <jordan.ledoux@gmail.com> wrote:
> That's not how voting works in the PHP project. The 2/3 is for whether =
or not the feature change should be made at all. In the case that there =
are multiple implementations or variations, the choice between those is =
usually simple majority. People can and do vote no on the main 2/3 vote =
if they feel that only one of the implementations/variations are =
acceptable.



Isn't it odd, if I had a vote, I'd have changed my first one to no if it =
meant jumping the default from 10 to 12 (ref shared hosting, and low =
powered servers)... doesn't matter though, when I finally get around to =
updating WordPress to use password_hash(), I'll probably set the cost =
rather than using the default (weird how that happens, some people think =
they are making things more secure, but end up making things worse).

Craig